nl80211.c 297.7 KB
Newer Older
1 2 3
/*
 * This is the new netlink-based wireless configuration interface.
 *
4
 * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5 6 7 8 9
 */

#include <linux/if.h>
#include <linux/module.h>
#include <linux/err.h>
10
#include <linux/slab.h>
11 12 13 14 15 16
#include <linux/list.h>
#include <linux/if_ether.h>
#include <linux/ieee80211.h>
#include <linux/nl80211.h>
#include <linux/rtnetlink.h>
#include <linux/netlink.h>
17
#include <linux/etherdevice.h>
18
#include <net/net_namespace.h>
19 20
#include <net/genetlink.h>
#include <net/cfg80211.h>
21
#include <net/sock.h>
22
#include <net/inet_connection_sock.h>
23 24
#include "core.h"
#include "nl80211.h"
25
#include "reg.h"
26
#include "rdev-ops.h"
27

28 29 30 31 32
static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
				   struct genl_info *info,
				   struct cfg80211_crypto_settings *settings,
				   int cipher_limit);

33 34 35 36 37
static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
			    struct genl_info *info);
static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
			      struct genl_info *info);

38 39
/* the netlink family */
static struct genl_family nl80211_fam = {
40 41 42 43
	.id = GENL_ID_GENERATE,		/* don't bother with a hardcoded ID */
	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
	.hdrsize = 0,			/* no private header */
	.version = 1,			/* no particular meaning now */
44
	.maxattr = NL80211_ATTR_MAX,
45
	.netnsok = true,
46 47
	.pre_doit = nl80211_pre_doit,
	.post_doit = nl80211_post_doit,
48 49
};

50 51 52
/* returns ERR_PTR values */
static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
53
{
54 55 56 57 58 59 60
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *result = NULL;
	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
	u64 wdev_id;
	int wiphy_idx = -1;
	int ifidx = -1;
61

62
	ASSERT_RTNL();
63

64 65
	if (!have_ifidx && !have_wdev_id)
		return ERR_PTR(-EINVAL);
66

67 68 69 70 71
	if (have_ifidx)
		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
	if (have_wdev_id) {
		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
		wiphy_idx = wdev_id >> 32;
72 73
	}

74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		struct wireless_dev *wdev;

		if (wiphy_net(&rdev->wiphy) != netns)
			continue;

		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
			continue;

		list_for_each_entry(wdev, &rdev->wdev_list, list) {
			if (have_ifidx && wdev->netdev &&
			    wdev->netdev->ifindex == ifidx) {
				result = wdev;
				break;
			}
			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
				result = wdev;
				break;
			}
		}

		if (result)
			break;
	}

	if (result)
		return result;
	return ERR_PTR(-ENODEV);
102 103
}

104
static struct cfg80211_registered_device *
105
__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
106
{
107 108
	struct cfg80211_registered_device *rdev = NULL, *tmp;
	struct net_device *netdev;
109

110
	ASSERT_RTNL();
111

112
	if (!attrs[NL80211_ATTR_WIPHY] &&
113 114
	    !attrs[NL80211_ATTR_IFINDEX] &&
	    !attrs[NL80211_ATTR_WDEV])
115 116
		return ERR_PTR(-EINVAL);

117
	if (attrs[NL80211_ATTR_WIPHY])
118
		rdev = cfg80211_rdev_by_wiphy_idx(
119
				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
120

121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144
	if (attrs[NL80211_ATTR_WDEV]) {
		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
		struct wireless_dev *wdev;
		bool found = false;

		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
		if (tmp) {
			/* make sure wdev exists */
			list_for_each_entry(wdev, &tmp->wdev_list, list) {
				if (wdev->identifier != (u32)wdev_id)
					continue;
				found = true;
				break;
			}

			if (!found)
				tmp = NULL;

			if (rdev && tmp != rdev)
				return ERR_PTR(-EINVAL);
			rdev = tmp;
		}
	}

145 146
	if (attrs[NL80211_ATTR_IFINDEX]) {
		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
J
Johannes Berg 已提交
147
		netdev = dev_get_by_index(netns, ifindex);
148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165
		if (netdev) {
			if (netdev->ieee80211_ptr)
				tmp = wiphy_to_dev(
						netdev->ieee80211_ptr->wiphy);
			else
				tmp = NULL;

			dev_put(netdev);

			/* not wireless device -- return error */
			if (!tmp)
				return ERR_PTR(-EINVAL);

			/* mismatch -- return error */
			if (rdev && tmp != rdev)
				return ERR_PTR(-EINVAL);

			rdev = tmp;
166 167 168
		}
	}

J
Johannes Berg 已提交
169 170
	if (!rdev)
		return ERR_PTR(-ENODEV);
171

J
Johannes Berg 已提交
172 173 174 175
	if (netns != wiphy_net(&rdev->wiphy))
		return ERR_PTR(-ENODEV);

	return rdev;
176 177 178 179 180 181 182 183 184 185
}

/*
 * This function returns a pointer to the driver
 * that the genl_info item that is passed refers to.
 *
 * The result of this can be a PTR_ERR and hence must
 * be checked with IS_ERR() for errors.
 */
static struct cfg80211_registered_device *
J
Johannes Berg 已提交
186
cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
187
{
188
	return __cfg80211_rdev_from_attrs(netns, info->attrs);
189 190
}

191
/* policy for the attributes */
A
Alexey Dobriyan 已提交
192
static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
193 194
	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
195
				      .len = 20-1 },
196
	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
197

198
	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
S
Sujith 已提交
199
	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
200 201 202 203
	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },

204 205 206 207
	[NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
	[NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
208
	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
209 210 211 212

	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
213

E
Eliad Peller 已提交
214 215
	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
216

217
	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
218 219 220 221 222
	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
				    .len = WLAN_MAX_KEY_LEN },
	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
223
	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
224
	[NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
225 226 227 228 229 230 231

	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
				       .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
				       .len = IEEE80211_MAX_DATA_LEN },
232 233 234 235 236
	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
					       .len = NL80211_MAX_SUPP_RATES },
237
	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
238
	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
J
Johannes Berg 已提交
239
	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
240
	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
241
				   .len = IEEE80211_MAX_MESH_ID_LEN },
242
	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
243

244 245 246
	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },

247 248 249
	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
250 251
	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
					   .len = NL80211_MAX_SUPP_RATES },
252
	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
253

254
	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
255
	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
256

257
	[NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
258 259 260 261

	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
			      .len = IEEE80211_MAX_DATA_LEN },
262 263
	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
264 265 266 267 268

	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
				.len = IEEE80211_MAX_SSID_LEN },
	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
J
Johannes Berg 已提交
269
	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
270
	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
271
	[NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
272 273 274
	[NL80211_ATTR_STA_FLAGS2] = {
		.len = sizeof(struct nl80211_sta_flag_update),
	},
275
	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
276 277
	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
S
Samuel Ortiz 已提交
278 279 280
	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
281
	[NL80211_ATTR_PID] = { .type = NLA_U32 },
282
	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
S
Samuel Ortiz 已提交
283 284
	[NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
				 .len = WLAN_PMKID_LEN },
285 286
	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
287
	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
288 289 290
	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
				 .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
K
Kalle Valo 已提交
291
	[NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
292
	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
293
	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
294
	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
295 296
	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
297
	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
298 299
	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
300
	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
301
	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
302
	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
J
Johannes Berg 已提交
303
	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
304
	[NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
305
	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
306
	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
307
	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
308
	[NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
309 310 311 312
	[NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
					 .len = IEEE80211_MAX_DATA_LEN },
	[NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
					 .len = IEEE80211_MAX_DATA_LEN },
313
	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
314
	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
315
	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
316 317 318 319 320
	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
321
	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
322 323
	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
				      .len = IEEE80211_MAX_DATA_LEN },
324
	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
325 326 327 328
	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
		.len = NL80211_HT_CAPABILITY_LEN
	},
329
	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
330
	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
331
	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
332
	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
333
	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
334
	[NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
M
Mahesh Palivela 已提交
335
	[NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
336
	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
337 338
	[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
	[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
339 340
	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
341 342
	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
343
	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
344 345 346 347
	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
		.len = NL80211_VHT_CAPABILITY_LEN,
	},
348 349 350
	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
				  .len = IEEE80211_MAX_DATA_LEN },
351
	[NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
352 353 354 355 356
	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
	[NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
	[NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
357 358
};

359
/* policy for the key attributes */
A
Alexey Dobriyan 已提交
360
static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
J
Johannes Berg 已提交
361
	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
362 363
	[NL80211_KEY_IDX] = { .type = NLA_U8 },
	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
364
	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
365 366
	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
367
	[NL80211_KEY_TYPE] = { .type = NLA_U32 },
368 369 370 371 372 373 374 375
	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
};

/* policy for the key default flags */
static const struct nla_policy
nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
376 377
};

J
Johannes Berg 已提交
378 379 380 381 382 383 384
/* policy for WoWLAN attributes */
static const struct nla_policy
nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
385 386 387 388
	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408
	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
};

static const struct nla_policy
nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
	},
	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
	},
	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
J
Johannes Berg 已提交
409 410
};

411 412 413 414 415 416 417 418
/* policy for coalesce rule attributes */
static const struct nla_policy
nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
	[NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
};

419 420 421 422 423 424 425 426
/* policy for GTK rekey offload attributes */
static const struct nla_policy
nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
	[NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
	[NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
	[NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
};

427 428
static const struct nla_policy
nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
429
	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
430
						 .len = IEEE80211_MAX_SSID_LEN },
431
	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
432 433
};

434 435 436 437
static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
				     struct netlink_callback *cb,
				     struct cfg80211_registered_device **rdev,
				     struct wireless_dev **wdev)
438
{
439
	int err;
440

441
	rtnl_lock();
442

443 444 445 446 447 448
	if (!cb->args[0]) {
		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
				  nl80211_policy);
		if (err)
			goto out_unlock;
449

450 451 452 453 454 455 456
		*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
						   nl80211_fam.attrbuf);
		if (IS_ERR(*wdev)) {
			err = PTR_ERR(*wdev);
			goto out_unlock;
		}
		*rdev = wiphy_to_dev((*wdev)->wiphy);
457 458
		/* 0 is the first index - add 1 to parse only once */
		cb->args[0] = (*rdev)->wiphy_idx + 1;
459 460
		cb->args[1] = (*wdev)->identifier;
	} else {
461 462
		/* subtract the 1 again here */
		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
463
		struct wireless_dev *tmp;
464

465 466 467 468 469 470
		if (!wiphy) {
			err = -ENODEV;
			goto out_unlock;
		}
		*rdev = wiphy_to_dev(wiphy);
		*wdev = NULL;
471

472 473 474 475 476 477
		list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
			if (tmp->identifier == cb->args[1]) {
				*wdev = tmp;
				break;
			}
		}
478

479 480 481 482
		if (!*wdev) {
			err = -ENODEV;
			goto out_unlock;
		}
483 484 485
	}

	return 0;
486
 out_unlock:
487 488 489 490
	rtnl_unlock();
	return err;
}

491
static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
492 493 494 495
{
	rtnl_unlock();
}

496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525
/* IE validation */
static bool is_valid_ie_attr(const struct nlattr *attr)
{
	const u8 *pos;
	int len;

	if (!attr)
		return true;

	pos = nla_data(attr);
	len = nla_len(attr);

	while (len) {
		u8 elemlen;

		if (len < 2)
			return false;
		len -= 2;

		elemlen = pos[1];
		if (elemlen > len)
			return false;

		len -= elemlen;
		pos += 2 + elemlen;
	}

	return true;
}

526
/* message building helper */
527
static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
528 529 530
				   int flags, u8 cmd)
{
	/* since there is no private header just add the generic one */
531
	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
532 533
}

534
static int nl80211_msg_put_channel(struct sk_buff *msg,
535 536
				   struct ieee80211_channel *chan,
				   bool large)
537
{
538 539 540
	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
			chan->center_freq))
		goto nla_put_failure;
541

542 543 544 545 546 547 548 549 550
	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
		goto nla_put_failure;
	if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
		goto nla_put_failure;
	if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
		goto nla_put_failure;
551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566
	if (chan->flags & IEEE80211_CHAN_RADAR) {
		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
			goto nla_put_failure;
		if (large) {
			u32 time;

			time = elapsed_jiffies_msecs(chan->dfs_state_entered);

			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
					chan->dfs_state))
				goto nla_put_failure;
			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
					time))
				goto nla_put_failure;
		}
	}
567

568 569 570 571 572 573 574 575 576 577 578 579 580 581 582
	if (large) {
		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
			goto nla_put_failure;
		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
			goto nla_put_failure;
	}

583 584 585
	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
			DBM_TO_MBM(chan->max_power)))
		goto nla_put_failure;
586 587 588 589 590 591 592

	return 0;

 nla_put_failure:
	return -ENOBUFS;
}

593 594
/* netlink command implementations */

595 596 597
struct key_parse {
	struct key_params p;
	int idx;
598
	int type;
599
	bool def, defmgmt;
600
	bool def_uni, def_multi;
601 602 603 604 605 606 607 608 609 610 611 612 613
};

static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
{
	struct nlattr *tb[NL80211_KEY_MAX + 1];
	int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
				   nl80211_key_policy);
	if (err)
		return err;

	k->def = !!tb[NL80211_KEY_DEFAULT];
	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];

614 615 616 617 618 619 620
	if (k->def) {
		k->def_uni = true;
		k->def_multi = true;
	}
	if (k->defmgmt)
		k->def_multi = true;

621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636
	if (tb[NL80211_KEY_IDX])
		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);

	if (tb[NL80211_KEY_DATA]) {
		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
	}

	if (tb[NL80211_KEY_SEQ]) {
		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
	}

	if (tb[NL80211_KEY_CIPHER])
		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);

637 638 639 640 641 642
	if (tb[NL80211_KEY_TYPE]) {
		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
	}

643 644
	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
645 646 647
		err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
				       tb[NL80211_KEY_DEFAULT_TYPES],
				       nl80211_key_default_policy);
648 649 650 651 652 653 654
		if (err)
			return err;

		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
	}

655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678
	return 0;
}

static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
{
	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
	}

	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
	}

	if (info->attrs[NL80211_ATTR_KEY_IDX])
		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);

	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);

	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];

679 680 681 682 683 684 685
	if (k->def) {
		k->def_uni = true;
		k->def_multi = true;
	}
	if (k->defmgmt)
		k->def_multi = true;

686 687 688 689 690 691
	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
	}

692 693 694 695 696 697 698 699 700 701 702 703 704
	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
		int err = nla_parse_nested(
				kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
				info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
				nl80211_key_default_policy);
		if (err)
			return err;

		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
	}

705 706 707 708 709 710 711 712 713
	return 0;
}

static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
{
	int err;

	memset(k, 0, sizeof(*k));
	k->idx = -1;
714
	k->type = -1;
715 716 717 718 719 720 721 722 723 724 725 726

	if (info->attrs[NL80211_ATTR_KEY])
		err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
	else
		err = nl80211_parse_key_old(info, k);

	if (err)
		return err;

	if (k->def && k->defmgmt)
		return -EINVAL;

727 728 729 730 731
	if (k->defmgmt) {
		if (k->def_uni || !k->def_multi)
			return -EINVAL;
	}

732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747
	if (k->idx != -1) {
		if (k->defmgmt) {
			if (k->idx < 4 || k->idx > 5)
				return -EINVAL;
		} else if (k->def) {
			if (k->idx < 0 || k->idx > 3)
				return -EINVAL;
		} else {
			if (k->idx < 0 || k->idx > 5)
				return -EINVAL;
		}
	}

	return 0;
}

J
Johannes Berg 已提交
748 749
static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
750
		       struct nlattr *keys, bool *no_ht)
J
Johannes Berg 已提交
751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780
{
	struct key_parse parse;
	struct nlattr *key;
	struct cfg80211_cached_keys *result;
	int rem, err, def = 0;

	result = kzalloc(sizeof(*result), GFP_KERNEL);
	if (!result)
		return ERR_PTR(-ENOMEM);

	result->def = -1;
	result->defmgmt = -1;

	nla_for_each_nested(key, keys, rem) {
		memset(&parse, 0, sizeof(parse));
		parse.idx = -1;

		err = nl80211_parse_key_new(key, &parse);
		if (err)
			goto error;
		err = -EINVAL;
		if (!parse.p.key)
			goto error;
		if (parse.idx < 0 || parse.idx > 4)
			goto error;
		if (parse.def) {
			if (def)
				goto error;
			def = 1;
			result->def = parse.idx;
781 782
			if (!parse.def_uni || !parse.def_multi)
				goto error;
J
Johannes Berg 已提交
783 784 785
		} else if (parse.defmgmt)
			goto error;
		err = cfg80211_validate_key_settings(rdev, &parse.p,
786
						     parse.idx, false, NULL);
J
Johannes Berg 已提交
787 788 789 790 791 792
		if (err)
			goto error;
		result->params[parse.idx].cipher = parse.p.cipher;
		result->params[parse.idx].key_len = parse.p.key_len;
		result->params[parse.idx].key = result->data[parse.idx];
		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
793 794 795 796 797 798

		if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
		    parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
			if (no_ht)
				*no_ht = true;
		}
J
Johannes Berg 已提交
799 800 801 802 803 804 805 806 807 808 809 810 811 812 813
	}

	return result;
 error:
	kfree(result);
	return ERR_PTR(err);
}

static int nl80211_key_allowed(struct wireless_dev *wdev)
{
	ASSERT_WDEV_LOCK(wdev);

	switch (wdev->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
814
	case NL80211_IFTYPE_P2P_GO:
815
	case NL80211_IFTYPE_MESH_POINT:
J
Johannes Berg 已提交
816 817 818
		break;
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_STATION:
819
	case NL80211_IFTYPE_P2P_CLIENT:
820
		if (!wdev->current_bss)
J
Johannes Berg 已提交
821 822 823 824 825 826 827 828 829
			return -ENOLINK;
		break;
	default:
		return -EINVAL;
	}

	return 0;
}

830 831 832 833 834 835 836 837 838 839
static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
{
	struct nlattr *nl_modes = nla_nest_start(msg, attr);
	int i;

	if (!nl_modes)
		goto nla_put_failure;

	i = 0;
	while (ifmodes) {
840 841
		if ((ifmodes & 1) && nla_put_flag(msg, i))
			goto nla_put_failure;
842 843 844 845 846 847 848 849 850 851 852 853
		ifmodes >>= 1;
		i++;
	}

	nla_nest_end(msg, nl_modes);
	return 0;

nla_put_failure:
	return -ENOBUFS;
}

static int nl80211_put_iface_combinations(struct wiphy *wiphy,
854 855
					  struct sk_buff *msg,
					  bool large)
856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884
{
	struct nlattr *nl_combis;
	int i, j;

	nl_combis = nla_nest_start(msg,
				NL80211_ATTR_INTERFACE_COMBINATIONS);
	if (!nl_combis)
		goto nla_put_failure;

	for (i = 0; i < wiphy->n_iface_combinations; i++) {
		const struct ieee80211_iface_combination *c;
		struct nlattr *nl_combi, *nl_limits;

		c = &wiphy->iface_combinations[i];

		nl_combi = nla_nest_start(msg, i + 1);
		if (!nl_combi)
			goto nla_put_failure;

		nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
		if (!nl_limits)
			goto nla_put_failure;

		for (j = 0; j < c->n_limits; j++) {
			struct nlattr *nl_limit;

			nl_limit = nla_nest_start(msg, j + 1);
			if (!nl_limit)
				goto nla_put_failure;
885 886 887
			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
					c->limits[j].max))
				goto nla_put_failure;
888 889 890 891 892 893 894 895
			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
						c->limits[j].types))
				goto nla_put_failure;
			nla_nest_end(msg, nl_limit);
		}

		nla_nest_end(msg, nl_limits);

896 897 898 899 900 901 902 903
		if (c->beacon_int_infra_match &&
		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
			goto nla_put_failure;
		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
				c->num_different_channels) ||
		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
				c->max_interfaces))
			goto nla_put_failure;
904 905 906 907
		if (large &&
		    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
				c->radar_detect_widths))
			goto nla_put_failure;
908 909 910 911 912 913 914 915 916 917 918

		nla_nest_end(msg, nl_combi);
	}

	nla_nest_end(msg, nl_combis);

	return 0;
nla_put_failure:
	return -ENOBUFS;
}

919
#ifdef CONFIG_PM
920 921 922
static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
					struct sk_buff *msg)
{
923
	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959
	struct nlattr *nl_tcp;

	if (!tcp)
		return 0;

	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
	if (!nl_tcp)
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
			tcp->data_payload_max))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
			tcp->data_payload_max))
		return -ENOBUFS;

	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
		return -ENOBUFS;

	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
				sizeof(*tcp->tok), tcp->tok))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
			tcp->data_interval_max))
		return -ENOBUFS;

	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
			tcp->wake_payload_max))
		return -ENOBUFS;

	nla_nest_end(msg, nl_tcp);
	return 0;
}

960
static int nl80211_send_wowlan(struct sk_buff *msg,
961 962
			       struct cfg80211_registered_device *dev,
			       bool large)
963
{
964
	struct nlattr *nl_wowlan;
965

966
	if (!dev->wiphy.wowlan)
967
		return 0;
968

969 970 971
	nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
	if (!nl_wowlan)
		return -ENOBUFS;
972

973
	if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
974
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
975
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
976
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
977
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
978
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
979
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
980
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
981
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
982
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
983
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
984
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
985
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
986
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
987
	    ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
988 989
	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
		return -ENOBUFS;
990

991
	if (dev->wiphy.wowlan->n_patterns) {
992
		struct nl80211_pattern_support pat = {
993 994 995 996
			.max_patterns = dev->wiphy.wowlan->n_patterns,
			.min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
			.max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
			.max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
997
		};
998

999 1000 1001 1002
		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
			    sizeof(pat), &pat))
			return -ENOBUFS;
	}
1003

1004 1005 1006
	if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
		return -ENOBUFS;

1007
	nla_nest_end(msg, nl_wowlan);
1008

1009 1010 1011
	return 0;
}
#endif
1012

1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033
static int nl80211_send_coalesce(struct sk_buff *msg,
				 struct cfg80211_registered_device *dev)
{
	struct nl80211_coalesce_rule_support rule;

	if (!dev->wiphy.coalesce)
		return 0;

	rule.max_rules = dev->wiphy.coalesce->n_rules;
	rule.max_delay = dev->wiphy.coalesce->max_delay;
	rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
	rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
	rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
	rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;

	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
		return -ENOBUFS;

	return 0;
}

1034 1035 1036 1037 1038 1039
static int nl80211_send_band_rateinfo(struct sk_buff *msg,
				      struct ieee80211_supported_band *sband)
{
	struct nlattr *nl_rates, *nl_rate;
	struct ieee80211_rate *rate;
	int i;
1040

1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052
	/* add HT info */
	if (sband->ht_cap.ht_supported &&
	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
		     sizeof(sband->ht_cap.mcs),
		     &sband->ht_cap.mcs) ||
	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
			 sband->ht_cap.cap) ||
	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
			sband->ht_cap.ampdu_factor) ||
	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
			sband->ht_cap.ampdu_density)))
		return -ENOBUFS;
1053

1054 1055 1056 1057 1058 1059 1060 1061
	/* add VHT info */
	if (sband->vht_cap.vht_supported &&
	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
		     sizeof(sband->vht_cap.vht_mcs),
		     &sband->vht_cap.vht_mcs) ||
	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
			 sband->vht_cap.cap)))
		return -ENOBUFS;
1062

1063 1064 1065 1066
	/* add bitrates */
	nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
	if (!nl_rates)
		return -ENOBUFS;
1067

1068 1069 1070 1071
	for (i = 0; i < sband->n_bitrates; i++) {
		nl_rate = nla_nest_start(msg, i);
		if (!nl_rate)
			return -ENOBUFS;
1072

1073 1074 1075 1076 1077 1078 1079 1080
		rate = &sband->bitrates[i];
		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
				rate->bitrate))
			return -ENOBUFS;
		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
		    nla_put_flag(msg,
				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
			return -ENOBUFS;
1081

1082 1083
		nla_nest_end(msg, nl_rate);
	}
J
Johannes Berg 已提交
1084

1085
	nla_nest_end(msg, nl_rates);
1086

1087 1088
	return 0;
}
1089

1090 1091 1092 1093 1094 1095 1096 1097
static int
nl80211_send_mgmt_stypes(struct sk_buff *msg,
			 const struct ieee80211_txrx_stypes *mgmt_stypes)
{
	u16 stypes;
	struct nlattr *nl_ftypes, *nl_ifs;
	enum nl80211_iftype ift;
	int i;
1098

1099 1100
	if (!mgmt_stypes)
		return 0;
1101

1102 1103 1104
	nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
	if (!nl_ifs)
		return -ENOBUFS;
1105

1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118
	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
		nl_ftypes = nla_nest_start(msg, ift);
		if (!nl_ftypes)
			return -ENOBUFS;
		i = 0;
		stypes = mgmt_stypes[ift].tx;
		while (stypes) {
			if ((stypes & 1) &&
			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
					(i << 4) | IEEE80211_FTYPE_MGMT))
				return -ENOBUFS;
			stypes >>= 1;
			i++;
1119
		}
1120 1121
		nla_nest_end(msg, nl_ftypes);
	}
1122

1123
	nla_nest_end(msg, nl_ifs);
1124

1125 1126 1127
	nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
	if (!nl_ifs)
		return -ENOBUFS;
1128

1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145
	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
		nl_ftypes = nla_nest_start(msg, ift);
		if (!nl_ftypes)
			return -ENOBUFS;
		i = 0;
		stypes = mgmt_stypes[ift].rx;
		while (stypes) {
			if ((stypes & 1) &&
			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
					(i << 4) | IEEE80211_FTYPE_MGMT))
				return -ENOBUFS;
			stypes >>= 1;
			i++;
		}
		nla_nest_end(msg, nl_ftypes);
	}
	nla_nest_end(msg, nl_ifs);
1146

1147 1148
	return 0;
}
1149

1150 1151 1152 1153 1154 1155 1156
struct nl80211_dump_wiphy_state {
	s64 filter_wiphy;
	long start;
	long split_start, band_start, chan_start;
	bool split;
};

1157 1158
static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
			      struct sk_buff *msg, u32 portid, u32 seq,
1159
			      int flags, struct nl80211_dump_wiphy_state *state)
1160 1161 1162 1163 1164 1165 1166 1167 1168 1169
{
	void *hdr;
	struct nlattr *nl_bands, *nl_band;
	struct nlattr *nl_freqs, *nl_freq;
	struct nlattr *nl_cmds;
	enum ieee80211_band band;
	struct ieee80211_channel *chan;
	int i;
	const struct ieee80211_txrx_stypes *mgmt_stypes =
				dev->wiphy.mgmt_stypes;
1170
	u32 features;
1171

1172 1173 1174
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
	if (!hdr)
		return -ENOBUFS;
1175

1176 1177
	if (WARN_ON(!state))
		return -EINVAL;
1178

1179 1180 1181 1182 1183
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
			   wiphy_name(&dev->wiphy)) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
			cfg80211_rdev_list_generation))
1184 1185
		goto nla_put_failure;

1186
	switch (state->split_start) {
1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207
	case 0:
		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
			       dev->wiphy.retry_short) ||
		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
			       dev->wiphy.retry_long) ||
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
				dev->wiphy.frag_threshold) ||
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
				dev->wiphy.rts_threshold) ||
		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
			       dev->wiphy.coverage_class) ||
		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
			       dev->wiphy.max_scan_ssids) ||
		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
			       dev->wiphy.max_sched_scan_ssids) ||
		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
				dev->wiphy.max_scan_ie_len) ||
		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
				dev->wiphy.max_sched_scan_ie_len) ||
		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
			       dev->wiphy.max_match_sets))
1208
			goto nla_put_failure;
1209 1210 1211

		if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1212
			goto nla_put_failure;
1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226
		if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
			goto nla_put_failure;
		if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1227
			goto nla_put_failure;
1228 1229 1230
		if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
		    nla_put_flag(msg, WIPHY_FLAG_SUPPORTS_5_10_MHZ))
			goto nla_put_failure;
1231

1232 1233
		state->split_start++;
		if (state->split)
1234 1235 1236 1237 1238 1239
			break;
	case 1:
		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
			    sizeof(u32) * dev->wiphy.n_cipher_suites,
			    dev->wiphy.cipher_suites))
			goto nla_put_failure;
1240

1241 1242 1243
		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
			       dev->wiphy.max_num_pmkids))
			goto nla_put_failure;
S
Samuel Ortiz 已提交
1244

1245 1246
		if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1247
			goto nla_put_failure;
S
Samuel Ortiz 已提交
1248

1249 1250 1251 1252
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
				dev->wiphy.available_antennas_tx) ||
		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
				dev->wiphy.available_antennas_rx))
1253
			goto nla_put_failure;
S
Samuel Ortiz 已提交
1254

1255 1256 1257 1258
		if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
				dev->wiphy.probe_resp_offload))
			goto nla_put_failure;
1259

1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275
		if ((dev->wiphy.available_antennas_tx ||
		     dev->wiphy.available_antennas_rx) &&
		    dev->ops->get_antenna) {
			u32 tx_ant = 0, rx_ant = 0;
			int res;
			res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
			if (!res) {
				if (nla_put_u32(msg,
						NL80211_ATTR_WIPHY_ANTENNA_TX,
						tx_ant) ||
				    nla_put_u32(msg,
						NL80211_ATTR_WIPHY_ANTENNA_RX,
						rx_ant))
					goto nla_put_failure;
			}
		}
1276

1277 1278
		state->split_start++;
		if (state->split)
1279 1280 1281 1282 1283
			break;
	case 2:
		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
					dev->wiphy.interface_modes))
				goto nla_put_failure;
1284 1285
		state->split_start++;
		if (state->split)
1286 1287 1288 1289 1290
			break;
	case 3:
		nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
		if (!nl_bands)
			goto nla_put_failure;
1291

1292 1293
		for (band = state->band_start;
		     band < IEEE80211_NUM_BANDS; band++) {
1294
			struct ieee80211_supported_band *sband;
1295

1296
			sband = dev->wiphy.bands[band];
1297

1298 1299 1300 1301 1302
			if (!sband)
				continue;

			nl_band = nla_nest_start(msg, band);
			if (!nl_band)
1303
				goto nla_put_failure;
1304

1305
			switch (state->chan_start) {
1306 1307
			case 0:
				if (nl80211_send_band_rateinfo(msg, sband))
1308
					goto nla_put_failure;
1309 1310
				state->chan_start++;
				if (state->split)
1311 1312 1313 1314 1315 1316 1317 1318
					break;
			default:
				/* add frequencies */
				nl_freqs = nla_nest_start(
					msg, NL80211_BAND_ATTR_FREQS);
				if (!nl_freqs)
					goto nla_put_failure;

1319
				for (i = state->chan_start - 1;
1320 1321 1322 1323 1324 1325 1326 1327
				     i < sband->n_channels;
				     i++) {
					nl_freq = nla_nest_start(msg, i);
					if (!nl_freq)
						goto nla_put_failure;

					chan = &sband->channels[i];

1328 1329 1330
					if (nl80211_msg_put_channel(
							msg, chan,
							state->split))
1331 1332 1333
						goto nla_put_failure;

					nla_nest_end(msg, nl_freq);
1334
					if (state->split)
1335 1336 1337
						break;
				}
				if (i < sband->n_channels)
1338
					state->chan_start = i + 2;
1339
				else
1340
					state->chan_start = 0;
1341 1342 1343 1344 1345
				nla_nest_end(msg, nl_freqs);
			}

			nla_nest_end(msg, nl_band);

1346
			if (state->split) {
1347
				/* start again here */
1348
				if (state->chan_start)
1349 1350
					band--;
				break;
1351 1352
			}
		}
1353
		nla_nest_end(msg, nl_bands);
1354

1355
		if (band < IEEE80211_NUM_BANDS)
1356
			state->band_start = band + 1;
1357
		else
1358
			state->band_start = 0;
J
Johannes Berg 已提交
1359

1360
		/* if bands & channels are done, continue outside */
1361 1362 1363
		if (state->band_start == 0 && state->chan_start == 0)
			state->split_start++;
		if (state->split)
1364 1365 1366 1367
			break;
	case 4:
		nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
		if (!nl_cmds)
1368 1369
			goto nla_put_failure;

1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
		i = 0;
#define CMD(op, n)							\
		 do {							\
			if (dev->ops->op) {				\
				i++;					\
				if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
					goto nla_put_failure;		\
			}						\
		} while (0)

		CMD(add_virtual_intf, NEW_INTERFACE);
		CMD(change_virtual_intf, SET_INTERFACE);
		CMD(add_key, NEW_KEY);
		CMD(start_ap, START_AP);
		CMD(add_station, NEW_STATION);
		CMD(add_mpath, NEW_MPATH);
		CMD(update_mesh_config, SET_MESH_CONFIG);
		CMD(change_bss, SET_BSS);
		CMD(auth, AUTHENTICATE);
		CMD(assoc, ASSOCIATE);
		CMD(deauth, DEAUTHENTICATE);
		CMD(disassoc, DISASSOCIATE);
		CMD(join_ibss, JOIN_IBSS);
		CMD(join_mesh, JOIN_MESH);
		CMD(set_pmksa, SET_PMKSA);
		CMD(del_pmksa, DEL_PMKSA);
		CMD(flush_pmksa, FLUSH_PMKSA);
		if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
			CMD(remain_on_channel, REMAIN_ON_CHANNEL);
		CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
		CMD(mgmt_tx, FRAME);
		CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
		if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1405 1406
				goto nla_put_failure;
		}
1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
		if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
		    dev->ops->join_mesh) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
				goto nla_put_failure;
		}
		CMD(set_wds_peer, SET_WDS_PEER);
		if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
			CMD(tdls_mgmt, TDLS_MGMT);
			CMD(tdls_oper, TDLS_OPER);
		}
		if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
			CMD(sched_scan_start, START_SCHED_SCAN);
		CMD(probe_client, PROBE_CLIENT);
		CMD(set_noack_map, SET_NOACK_MAP);
		if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
				goto nla_put_failure;
		}
		CMD(start_p2p_device, START_P2P_DEVICE);
		CMD(set_mcast_rate, SET_MCAST_RATE);
1429
		if (state->split) {
1430 1431
			CMD(crit_proto_start, CRIT_PROTOCOL_START);
			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1432 1433
			if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
				CMD(channel_switch, CHANNEL_SWITCH);
1434
		}
1435

1436 1437 1438
#ifdef CONFIG_NL80211_TESTMODE
		CMD(testmode_cmd, TESTMODE);
#endif
J
Johannes Berg 已提交
1439

1440
#undef CMD
J
Johannes Berg 已提交
1441

1442 1443 1444
		if (dev->ops->connect || dev->ops->auth) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1445
				goto nla_put_failure;
J
Johannes Berg 已提交
1446 1447
		}

1448 1449 1450 1451 1452 1453 1454
		if (dev->ops->disconnect || dev->ops->deauth) {
			i++;
			if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
				goto nla_put_failure;
		}

		nla_nest_end(msg, nl_cmds);
1455 1456
		state->split_start++;
		if (state->split)
1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471
			break;
	case 5:
		if (dev->ops->remain_on_channel &&
		    (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
		    nla_put_u32(msg,
				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
				dev->wiphy.max_remain_on_channel_duration))
			goto nla_put_failure;

		if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
			goto nla_put_failure;

		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
			goto nla_put_failure;
1472 1473
		state->split_start++;
		if (state->split)
1474 1475 1476
			break;
	case 6:
#ifdef CONFIG_PM
1477
		if (nl80211_send_wowlan(msg, dev, state->split))
1478
			goto nla_put_failure;
1479 1480
		state->split_start++;
		if (state->split)
1481 1482
			break;
#else
1483
		state->split_start++;
1484
#endif
1485 1486 1487 1488
	case 7:
		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
					dev->wiphy.software_iftypes))
			goto nla_put_failure;
J
Johannes Berg 已提交
1489

1490 1491
		if (nl80211_put_iface_combinations(&dev->wiphy, msg,
						   state->split))
1492
			goto nla_put_failure;
1493

1494 1495
		state->split_start++;
		if (state->split)
1496 1497 1498 1499 1500 1501
			break;
	case 8:
		if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
				dev->wiphy.ap_sme_capa))
			goto nla_put_failure;
1502

1503 1504 1505 1506 1507 1508
		features = dev->wiphy.features;
		/*
		 * We can only add the per-channel limit information if the
		 * dump is split, otherwise it makes it too big. Therefore
		 * only advertise it in that case.
		 */
1509
		if (state->split)
1510 1511
			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1512
			goto nla_put_failure;
J
Johannes Berg 已提交
1513

1514 1515 1516 1517 1518
		if (dev->wiphy.ht_capa_mod_mask &&
		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
			    sizeof(*dev->wiphy.ht_capa_mod_mask),
			    dev->wiphy.ht_capa_mod_mask))
			goto nla_put_failure;
1519

1520 1521 1522 1523 1524
		if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
		    dev->wiphy.max_acl_mac_addrs &&
		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
				dev->wiphy.max_acl_mac_addrs))
			goto nla_put_failure;
1525

1526 1527 1528 1529 1530 1531 1532 1533 1534 1535
		/*
		 * Any information below this point is only available to
		 * applications that can deal with it being split. This
		 * helps ensure that newly added capabilities don't break
		 * older tools by overrunning their buffers.
		 *
		 * We still increment split_start so that in the split
		 * case we'll continue with more data in the next round,
		 * but break unconditionally so unsplit data stops here.
		 */
1536
		state->split_start++;
1537 1538
		break;
	case 9:
1539 1540 1541 1542 1543 1544 1545 1546
		if (dev->wiphy.extended_capabilities &&
		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
			     dev->wiphy.extended_capabilities_len,
			     dev->wiphy.extended_capabilities) ||
		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
			     dev->wiphy.extended_capabilities_len,
			     dev->wiphy.extended_capabilities_mask)))
			goto nla_put_failure;
1547

1548 1549 1550 1551 1552 1553
		if (dev->wiphy.vht_capa_mod_mask &&
		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
			    sizeof(*dev->wiphy.vht_capa_mod_mask),
			    dev->wiphy.vht_capa_mod_mask))
			goto nla_put_failure;

1554 1555 1556 1557 1558 1559
		state->split_start++;
		break;
	case 10:
		if (nl80211_send_coalesce(msg, dev))
			goto nla_put_failure;

1560
		/* done */
1561
		state->split_start = 0;
1562 1563
		break;
	}
1564 1565 1566
	return genlmsg_end(msg, hdr);

 nla_put_failure:
1567 1568
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
1569 1570
}

1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605
static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
				    struct netlink_callback *cb,
				    struct nl80211_dump_wiphy_state *state)
{
	struct nlattr **tb = nl80211_fam.attrbuf;
	int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
			      tb, nl80211_fam.maxattr, nl80211_policy);
	/* ignore parse errors for backward compatibility */
	if (ret)
		return 0;

	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
	if (tb[NL80211_ATTR_WIPHY])
		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
	if (tb[NL80211_ATTR_WDEV])
		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
	if (tb[NL80211_ATTR_IFINDEX]) {
		struct net_device *netdev;
		struct cfg80211_registered_device *rdev;
		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);

		netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
		if (!netdev)
			return -ENODEV;
		if (netdev->ieee80211_ptr) {
			rdev = wiphy_to_dev(
				netdev->ieee80211_ptr->wiphy);
			state->filter_wiphy = rdev->wiphy_idx;
		}
		dev_put(netdev);
	}

	return 0;
}

1606 1607
static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
{
1608
	int idx = 0, ret;
1609
	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1610
	struct cfg80211_registered_device *dev;
1611

1612
	rtnl_lock();
1613 1614
	if (!state) {
		state = kzalloc(sizeof(*state), GFP_KERNEL);
J
John W. Linville 已提交
1615 1616
		if (!state) {
			rtnl_unlock();
1617
			return -ENOMEM;
1618
		}
1619 1620 1621 1622 1623 1624
		state->filter_wiphy = -1;
		ret = nl80211_dump_wiphy_parse(skb, cb, state);
		if (ret) {
			kfree(state);
			rtnl_unlock();
			return ret;
1625
		}
1626
		cb->args[0] = (long)state;
1627 1628
	}

1629
	list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1630 1631
		if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
			continue;
1632
		if (++idx <= state->start)
1633
			continue;
1634 1635
		if (state->filter_wiphy != -1 &&
		    state->filter_wiphy != dev->wiphy_idx)
1636 1637 1638 1639 1640 1641
			continue;
		/* attempt to fit multiple wiphy data chunks into the skb */
		do {
			ret = nl80211_send_wiphy(dev, skb,
						 NETLINK_CB(cb->skb).portid,
						 cb->nlh->nlmsg_seq,
1642
						 NLM_F_MULTI, state);
1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660
			if (ret < 0) {
				/*
				 * If sending the wiphy data didn't fit (ENOBUFS
				 * or EMSGSIZE returned), this SKB is still
				 * empty (so it's not too big because another
				 * wiphy dataset is already in the skb) and
				 * we've not tried to adjust the dump allocation
				 * yet ... then adjust the alloc size to be
				 * bigger, and return 1 but with the empty skb.
				 * This results in an empty message being RX'ed
				 * in userspace, but that is ignored.
				 *
				 * We can then retry with the larger buffer.
				 */
				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
				    !skb->len &&
				    cb->min_dump_alloc < 4096) {
					cb->min_dump_alloc = 4096;
1661
					rtnl_unlock();
1662 1663 1664 1665
					return 1;
				}
				idx--;
				break;
1666
			}
1667
		} while (state->split_start > 0);
1668
		break;
1669
	}
1670
	rtnl_unlock();
1671

1672
	state->start = idx;
1673 1674 1675 1676

	return skb->len;
}

1677 1678 1679 1680 1681 1682
static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
{
	kfree((void *)cb->args[0]);
	return 0;
}

1683 1684 1685
static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
{
	struct sk_buff *msg;
1686
	struct cfg80211_registered_device *dev = info->user_ptr[0];
1687
	struct nl80211_dump_wiphy_state state = {};
1688

1689
	msg = nlmsg_new(4096, GFP_KERNEL);
1690
	if (!msg)
1691
		return -ENOMEM;
1692

1693
	if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1694
			       &state) < 0) {
1695 1696 1697
		nlmsg_free(msg);
		return -ENOBUFS;
	}
1698

J
Johannes Berg 已提交
1699
	return genlmsg_reply(msg, info);
1700 1701
}

1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
};

static int parse_txq_params(struct nlattr *tb[],
			    struct ieee80211_txq_params *txq_params)
{
1713
	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1714 1715 1716 1717
	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
	    !tb[NL80211_TXQ_ATTR_AIFS])
		return -EINVAL;

1718
	txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1719 1720 1721 1722 1723
	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);

1724 1725 1726
	if (txq_params->ac >= NL80211_NUM_ACS)
		return -EINVAL;

1727 1728 1729
	return 0;
}

1730 1731 1732
static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
{
	/*
1733 1734 1735 1736 1737 1738 1739 1740 1741
	 * You can only set the channel explicitly for WDS interfaces,
	 * all others have their channel managed via their respective
	 * "establish a connection" command (connect, join, ...)
	 *
	 * For AP/GO and mesh mode, the channel can be set with the
	 * channel userspace API, but is only stored and passed to the
	 * low-level driver when the AP starts or the mesh is joined.
	 * This is for backward compatibility, userspace can also give
	 * the channel in the start-ap or join-mesh commands instead.
1742 1743
	 *
	 * Monitors are special as they are normally slaved to
1744 1745
	 * whatever else is going on, so they have their own special
	 * operation to set the monitor channel if possible.
1746 1747 1748 1749
	 */
	return !wdev ||
		wdev->iftype == NL80211_IFTYPE_AP ||
		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1750 1751
		wdev->iftype == NL80211_IFTYPE_MONITOR ||
		wdev->iftype == NL80211_IFTYPE_P2P_GO;
1752 1753
}

1754 1755 1756 1757
static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
				 struct genl_info *info,
				 struct cfg80211_chan_def *chandef)
{
1758
	u32 control_freq;
1759 1760 1761 1762 1763 1764 1765

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
		return -EINVAL;

	control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);

	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1766 1767 1768
	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
	chandef->center_freq1 = control_freq;
	chandef->center_freq2 = 0;
1769 1770 1771 1772 1773

	/* Primary channel not allowed */
	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
		return -EINVAL;

1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803
	if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
		enum nl80211_channel_type chantype;

		chantype = nla_get_u32(
				info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);

		switch (chantype) {
		case NL80211_CHAN_NO_HT:
		case NL80211_CHAN_HT20:
		case NL80211_CHAN_HT40PLUS:
		case NL80211_CHAN_HT40MINUS:
			cfg80211_chandef_create(chandef, chandef->chan,
						chantype);
			break;
		default:
			return -EINVAL;
		}
	} else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
		chandef->width =
			nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
		if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
			chandef->center_freq1 =
				nla_get_u32(
					info->attrs[NL80211_ATTR_CENTER_FREQ1]);
		if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
			chandef->center_freq2 =
				nla_get_u32(
					info->attrs[NL80211_ATTR_CENTER_FREQ2]);
	}

1804
	if (!cfg80211_chandef_valid(chandef))
1805 1806
		return -EINVAL;

1807 1808
	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
				     IEEE80211_CHAN_DISABLED))
1809 1810
		return -EINVAL;

1811 1812 1813 1814 1815
	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
	     chandef->width == NL80211_CHAN_WIDTH_10) &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
		return -EINVAL;

1816 1817 1818
	return 0;
}

1819 1820 1821 1822
static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
				 struct wireless_dev *wdev,
				 struct genl_info *info)
{
1823
	struct cfg80211_chan_def chandef;
1824
	int result;
1825 1826 1827 1828
	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;

	if (wdev)
		iftype = wdev->iftype;
1829 1830 1831 1832

	if (!nl80211_can_set_dev_channel(wdev))
		return -EOPNOTSUPP;

1833 1834 1835
	result = nl80211_parse_chandef(rdev, info, &chandef);
	if (result)
		return result;
1836

1837
	switch (iftype) {
1838 1839 1840 1841 1842 1843
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_P2P_GO:
		if (wdev->beacon_interval) {
			result = -EBUSY;
			break;
		}
1844
		if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1845 1846 1847
			result = -EINVAL;
			break;
		}
1848
		wdev->preset_chandef = chandef;
1849 1850
		result = 0;
		break;
1851
	case NL80211_IFTYPE_MESH_POINT:
1852
		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1853
		break;
1854
	case NL80211_IFTYPE_MONITOR:
1855
		result = cfg80211_set_monitor_channel(rdev, &chandef);
1856
		break;
1857
	default:
1858
		result = -EINVAL;
1859 1860 1861 1862 1863 1864 1865
	}

	return result;
}

static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
{
1866 1867
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *netdev = info->user_ptr[1];
1868

1869
	return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1870 1871
}

1872 1873
static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
{
1874 1875 1876
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
J
Johannes Berg 已提交
1877
	const u8 *bssid;
1878 1879 1880 1881

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

1882 1883
	if (netif_running(dev))
		return -EBUSY;
1884

1885 1886
	if (!rdev->ops->set_wds_peer)
		return -EOPNOTSUPP;
1887

1888 1889
	if (wdev->iftype != NL80211_IFTYPE_WDS)
		return -EOPNOTSUPP;
1890 1891

	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1892
	return rdev_set_wds_peer(rdev, dev, bssid);
1893 1894 1895
}


1896 1897 1898
static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev;
1899 1900
	struct net_device *netdev = NULL;
	struct wireless_dev *wdev;
B
Bill Jordan 已提交
1901
	int result = 0, rem_txq_params = 0;
1902
	struct nlattr *nl_txq_params;
1903 1904 1905
	u32 changed;
	u8 retry_short = 0, retry_long = 0;
	u32 frag_threshold = 0, rts_threshold = 0;
1906
	u8 coverage_class = 0;
1907

1908 1909
	ASSERT_RTNL();

1910 1911 1912 1913 1914 1915 1916 1917 1918
	/*
	 * Try to find the wiphy and netdev. Normally this
	 * function shouldn't need the netdev, but this is
	 * done for backward compatibility -- previously
	 * setting the channel was done per wiphy, but now
	 * it is per netdev. Previous userland like hostapd
	 * also passed a netdev to set_wiphy, so that it is
	 * possible to let that go to the right netdev!
	 */
1919

1920 1921 1922 1923
	if (info->attrs[NL80211_ATTR_IFINDEX]) {
		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);

		netdev = dev_get_by_index(genl_info_net(info), ifindex);
1924
		if (netdev && netdev->ieee80211_ptr)
1925
			rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1926
		else
1927
			netdev = NULL;
1928 1929
	}

1930
	if (!netdev) {
1931 1932
		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
						  info->attrs);
1933
		if (IS_ERR(rdev))
1934
			return PTR_ERR(rdev);
1935 1936 1937
		wdev = NULL;
		netdev = NULL;
		result = 0;
1938
	} else
1939 1940 1941 1942 1943 1944
		wdev = netdev->ieee80211_ptr;

	/*
	 * end workaround code, by now the rdev is available
	 * and locked, and wdev may or may not be NULL.
	 */
1945 1946

	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1947 1948
		result = cfg80211_dev_rename(
			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1949 1950 1951

	if (result)
		goto bad_res;
1952 1953 1954 1955 1956 1957 1958 1959 1960 1961

	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
		struct ieee80211_txq_params txq_params;
		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];

		if (!rdev->ops->set_txq_params) {
			result = -EOPNOTSUPP;
			goto bad_res;
		}

1962 1963 1964 1965 1966
		if (!netdev) {
			result = -EINVAL;
			goto bad_res;
		}

1967 1968 1969 1970 1971 1972
		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
			result = -EINVAL;
			goto bad_res;
		}

1973 1974 1975 1976 1977
		if (!netif_running(netdev)) {
			result = -ENETDOWN;
			goto bad_res;
		}

1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988
		nla_for_each_nested(nl_txq_params,
				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
				    rem_txq_params) {
			nla_parse(tb, NL80211_TXQ_ATTR_MAX,
				  nla_data(nl_txq_params),
				  nla_len(nl_txq_params),
				  txq_params_policy);
			result = parse_txq_params(tb, &txq_params);
			if (result)
				goto bad_res;

1989 1990
			result = rdev_set_txq_params(rdev, netdev,
						     &txq_params);
1991 1992 1993 1994
			if (result)
				goto bad_res;
		}
	}
1995

1996
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1997 1998 1999
		result = __nl80211_set_channel(rdev,
				nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
				info);
2000 2001 2002 2003
		if (result)
			goto bad_res;
	}

2004
	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2005
		struct wireless_dev *txp_wdev = wdev;
2006 2007 2008
		enum nl80211_tx_power_setting type;
		int idx, mbm = 0;

2009 2010 2011
		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
			txp_wdev = NULL;

2012
		if (!rdev->ops->set_tx_power) {
2013
			result = -EOPNOTSUPP;
2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030
			goto bad_res;
		}

		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
		type = nla_get_u32(info->attrs[idx]);

		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
		    (type != NL80211_TX_POWER_AUTOMATIC)) {
			result = -EINVAL;
			goto bad_res;
		}

		if (type != NL80211_TX_POWER_AUTOMATIC) {
			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
			mbm = nla_get_u32(info->attrs[idx]);
		}

2031
		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2032 2033 2034 2035
		if (result)
			goto bad_res;
	}

2036 2037 2038
	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
		u32 tx_ant, rx_ant;
2039 2040 2041
		if ((!rdev->wiphy.available_antennas_tx &&
		     !rdev->wiphy.available_antennas_rx) ||
		    !rdev->ops->set_antenna) {
2042 2043 2044 2045 2046 2047 2048
			result = -EOPNOTSUPP;
			goto bad_res;
		}

		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);

2049
		/* reject antenna configurations which don't match the
2050 2051 2052
		 * available antenna masks, except for the "all" mask */
		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2053 2054 2055 2056
			result = -EINVAL;
			goto bad_res;
		}

2057 2058
		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2059

2060
		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2061 2062 2063 2064
		if (result)
			goto bad_res;
	}

2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111
	changed = 0;

	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
		retry_short = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
		if (retry_short == 0) {
			result = -EINVAL;
			goto bad_res;
		}
		changed |= WIPHY_PARAM_RETRY_SHORT;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
		retry_long = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
		if (retry_long == 0) {
			result = -EINVAL;
			goto bad_res;
		}
		changed |= WIPHY_PARAM_RETRY_LONG;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
		frag_threshold = nla_get_u32(
			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
		if (frag_threshold < 256) {
			result = -EINVAL;
			goto bad_res;
		}
		if (frag_threshold != (u32) -1) {
			/*
			 * Fragments (apart from the last one) are required to
			 * have even length. Make the fragmentation code
			 * simpler by stripping LSB should someone try to use
			 * odd threshold value.
			 */
			frag_threshold &= ~0x1;
		}
		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
	}

	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
		rts_threshold = nla_get_u32(
			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
		changed |= WIPHY_PARAM_RTS_THRESHOLD;
	}

2112 2113 2114 2115 2116 2117
	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
		coverage_class = nla_get_u8(
			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
		changed |= WIPHY_PARAM_COVERAGE_CLASS;
	}

2118 2119 2120
	if (changed) {
		u8 old_retry_short, old_retry_long;
		u32 old_frag_threshold, old_rts_threshold;
2121
		u8 old_coverage_class;
2122 2123 2124 2125 2126 2127 2128 2129 2130 2131

		if (!rdev->ops->set_wiphy_params) {
			result = -EOPNOTSUPP;
			goto bad_res;
		}

		old_retry_short = rdev->wiphy.retry_short;
		old_retry_long = rdev->wiphy.retry_long;
		old_frag_threshold = rdev->wiphy.frag_threshold;
		old_rts_threshold = rdev->wiphy.rts_threshold;
2132
		old_coverage_class = rdev->wiphy.coverage_class;
2133 2134 2135 2136 2137 2138 2139 2140 2141

		if (changed & WIPHY_PARAM_RETRY_SHORT)
			rdev->wiphy.retry_short = retry_short;
		if (changed & WIPHY_PARAM_RETRY_LONG)
			rdev->wiphy.retry_long = retry_long;
		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
			rdev->wiphy.frag_threshold = frag_threshold;
		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
			rdev->wiphy.rts_threshold = rts_threshold;
2142 2143
		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
			rdev->wiphy.coverage_class = coverage_class;
2144

2145
		result = rdev_set_wiphy_params(rdev, changed);
2146 2147 2148 2149 2150
		if (result) {
			rdev->wiphy.retry_short = old_retry_short;
			rdev->wiphy.retry_long = old_retry_long;
			rdev->wiphy.frag_threshold = old_frag_threshold;
			rdev->wiphy.rts_threshold = old_rts_threshold;
2151
			rdev->wiphy.coverage_class = old_coverage_class;
2152 2153
		}
	}
2154

2155
 bad_res:
2156 2157
	if (netdev)
		dev_put(netdev);
2158 2159 2160
	return result;
}

2161 2162 2163 2164 2165
static inline u64 wdev_id(struct wireless_dev *wdev)
{
	return (u64)wdev->identifier |
	       ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
}
2166

2167 2168 2169
static int nl80211_send_chandef(struct sk_buff *msg,
				 struct cfg80211_chan_def *chandef)
{
2170
	WARN_ON(!cfg80211_chandef_valid(chandef));
2171

2172 2173 2174
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
			chandef->chan->center_freq))
		return -ENOBUFS;
2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191
	switch (chandef->width) {
	case NL80211_CHAN_WIDTH_20_NOHT:
	case NL80211_CHAN_WIDTH_20:
	case NL80211_CHAN_WIDTH_40:
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
				cfg80211_get_chandef_type(chandef)))
			return -ENOBUFS;
		break;
	default:
		break;
	}
	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
		return -ENOBUFS;
	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
		return -ENOBUFS;
	if (chandef->center_freq2 &&
	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2192 2193 2194 2195
		return -ENOBUFS;
	return 0;
}

2196
static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2197
			      struct cfg80211_registered_device *rdev,
2198
			      struct wireless_dev *wdev)
2199
{
2200
	struct net_device *dev = wdev->netdev;
2201 2202
	void *hdr;

2203
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2204 2205 2206
	if (!hdr)
		return -1;

2207 2208
	if (dev &&
	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2209
	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2210 2211 2212 2213
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2214
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2215
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2216 2217 2218 2219
	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
			rdev->devlist_generation ^
			(cfg80211_rdev_list_generation << 2)))
		goto nla_put_failure;
2220

2221
	if (rdev->ops->get_channel) {
2222 2223 2224 2225 2226 2227 2228 2229
		int ret;
		struct cfg80211_chan_def chandef;

		ret = rdev_get_channel(rdev, wdev, &chandef);
		if (ret == 0) {
			if (nl80211_send_chandef(msg, &chandef))
				goto nla_put_failure;
		}
2230 2231
	}

2232 2233 2234 2235 2236
	if (wdev->ssid_len) {
		if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
			goto nla_put_failure;
	}

2237 2238 2239
	return genlmsg_end(msg, hdr);

 nla_put_failure:
2240 2241
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
2242 2243 2244 2245 2246 2247 2248 2249
}

static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
{
	int wp_idx = 0;
	int if_idx = 0;
	int wp_start = cb->args[0];
	int if_start = cb->args[1];
2250
	struct cfg80211_registered_device *rdev;
2251 2252
	struct wireless_dev *wdev;

2253
	rtnl_lock();
2254 2255
	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2256
			continue;
J
Johannes Berg 已提交
2257 2258
		if (wp_idx < wp_start) {
			wp_idx++;
2259
			continue;
J
Johannes Berg 已提交
2260
		}
2261 2262
		if_idx = 0;

2263
		list_for_each_entry(wdev, &rdev->wdev_list, list) {
J
Johannes Berg 已提交
2264 2265
			if (if_idx < if_start) {
				if_idx++;
2266
				continue;
J
Johannes Berg 已提交
2267
			}
2268
			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2269
					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
2270
					       rdev, wdev) < 0) {
J
Johannes Berg 已提交
2271 2272 2273
				goto out;
			}
			if_idx++;
2274
		}
J
Johannes Berg 已提交
2275 2276

		wp_idx++;
2277
	}
J
Johannes Berg 已提交
2278
 out:
2279
	rtnl_unlock();
2280 2281 2282 2283 2284 2285 2286 2287 2288 2289

	cb->args[0] = wp_idx;
	cb->args[1] = if_idx;

	return skb->len;
}

static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
{
	struct sk_buff *msg;
2290
	struct cfg80211_registered_device *dev = info->user_ptr[0];
2291
	struct wireless_dev *wdev = info->user_ptr[1];
2292

2293
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2294
	if (!msg)
2295
		return -ENOMEM;
2296

2297
	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2298
			       dev, wdev) < 0) {
2299 2300 2301
		nlmsg_free(msg);
		return -ENOBUFS;
	}
2302

J
Johannes Berg 已提交
2303
	return genlmsg_reply(msg, info);
2304 2305
}

2306 2307 2308 2309 2310 2311
static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2312
	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335
};

static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
{
	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
	int flag;

	*mntrflags = 0;

	if (!nla)
		return -EINVAL;

	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
			     nla, mntr_flags_policy))
		return -EINVAL;

	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
		if (flags[flag])
			*mntrflags |= (1<<flag);

	return 0;
}

2336
static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2337 2338
			       struct net_device *netdev, u8 use_4addr,
			       enum nl80211_iftype iftype)
2339
{
2340
	if (!use_4addr) {
2341
		if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2342
			return -EBUSY;
2343
		return 0;
2344
	}
2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361

	switch (iftype) {
	case NL80211_IFTYPE_AP_VLAN:
		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
			return 0;
		break;
	case NL80211_IFTYPE_STATION:
		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
			return 0;
		break;
	default:
		break;
	}

	return -EOPNOTSUPP;
}

2362 2363
static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
{
2364
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2365
	struct vif_params params;
2366
	int err;
J
Johannes Berg 已提交
2367
	enum nl80211_iftype otype, ntype;
2368
	struct net_device *dev = info->user_ptr[1];
2369
	u32 _flags, *flags = NULL;
2370
	bool change = false;
2371

2372 2373
	memset(&params, 0, sizeof(params));

J
Johannes Berg 已提交
2374
	otype = ntype = dev->ieee80211_ptr->iftype;
2375

2376
	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2377
		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
J
Johannes Berg 已提交
2378
		if (otype != ntype)
2379
			change = true;
2380 2381
		if (ntype > NL80211_IFTYPE_MAX)
			return -EINVAL;
2382 2383
	}

2384
	if (info->attrs[NL80211_ATTR_MESH_ID]) {
2385 2386
		struct wireless_dev *wdev = dev->ieee80211_ptr;

2387 2388
		if (ntype != NL80211_IFTYPE_MESH_POINT)
			return -EINVAL;
2389 2390 2391 2392 2393 2394 2395 2396 2397 2398 2399
		if (netif_running(dev))
			return -EBUSY;

		wdev_lock(wdev);
		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
			     IEEE80211_MAX_MESH_ID_LEN);
		wdev->mesh_id_up_len =
			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
		       wdev->mesh_id_up_len);
		wdev_unlock(wdev);
2400 2401
	}

2402 2403 2404
	if (info->attrs[NL80211_ATTR_4ADDR]) {
		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
		change = true;
2405
		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2406
		if (err)
2407
			return err;
2408 2409 2410 2411
	} else {
		params.use_4addr = -1;
	}

2412
	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2413 2414
		if (ntype != NL80211_IFTYPE_MONITOR)
			return -EINVAL;
2415 2416
		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
					  &_flags);
2417
		if (err)
2418
			return err;
2419 2420 2421

		flags = &_flags;
		change = true;
2422
	}
J
Johannes Berg 已提交
2423

2424 2425 2426 2427
	if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
		return -EOPNOTSUPP;

2428
	if (change)
2429
		err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2430 2431
	else
		err = 0;
J
Johannes Berg 已提交
2432

2433 2434 2435
	if (!err && params.use_4addr != -1)
		dev->ieee80211_ptr->use_4addr = params.use_4addr;

2436 2437 2438 2439 2440
	return err;
}

static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
{
2441
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2442
	struct vif_params params;
2443
	struct wireless_dev *wdev;
2444
	struct sk_buff *msg;
2445 2446
	int err;
	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2447
	u32 flags;
2448

2449 2450
	memset(&params, 0, sizeof(params));

2451 2452 2453 2454 2455 2456 2457 2458 2459
	if (!info->attrs[NL80211_ATTR_IFNAME])
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_IFTYPE]) {
		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
		if (type > NL80211_IFTYPE_MAX)
			return -EINVAL;
	}

2460
	if (!rdev->ops->add_virtual_intf ||
2461 2462
	    !(rdev->wiphy.interface_modes & (1 << type)))
		return -EOPNOTSUPP;
2463

2464 2465 2466 2467 2468 2469 2470
	if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
			   ETH_ALEN);
		if (!is_valid_ether_addr(params.macaddr))
			return -EADDRNOTAVAIL;
	}

2471
	if (info->attrs[NL80211_ATTR_4ADDR]) {
2472
		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2473
		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2474
		if (err)
2475
			return err;
2476
	}
2477

2478 2479 2480 2481
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

2482 2483 2484
	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
				  &flags);
2485 2486 2487 2488 2489

	if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
		return -EOPNOTSUPP;

2490 2491 2492
	wdev = rdev_add_virtual_intf(rdev,
				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
				type, err ? NULL : &flags, &params);
2493 2494
	if (IS_ERR(wdev)) {
		nlmsg_free(msg);
2495
		return PTR_ERR(wdev);
2496
	}
2497

2498 2499 2500 2501
	switch (type) {
	case NL80211_IFTYPE_MESH_POINT:
		if (!info->attrs[NL80211_ATTR_MESH_ID])
			break;
2502 2503 2504 2505 2506 2507 2508 2509
		wdev_lock(wdev);
		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
			     IEEE80211_MAX_MESH_ID_LEN);
		wdev->mesh_id_up_len =
			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
		       wdev->mesh_id_up_len);
		wdev_unlock(wdev);
2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527
		break;
	case NL80211_IFTYPE_P2P_DEVICE:
		/*
		 * P2P Device doesn't have a netdev, so doesn't go
		 * through the netdev notifier and must be added here
		 */
		mutex_init(&wdev->mtx);
		INIT_LIST_HEAD(&wdev->event_list);
		spin_lock_init(&wdev->event_lock);
		INIT_LIST_HEAD(&wdev->mgmt_registrations);
		spin_lock_init(&wdev->mgmt_registrations_lock);

		wdev->identifier = ++rdev->wdev_id;
		list_add_rcu(&wdev->list, &rdev->wdev_list);
		rdev->devlist_generation++;
		break;
	default:
		break;
2528 2529
	}

2530
	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2531 2532 2533 2534 2535 2536
			       rdev, wdev) < 0) {
		nlmsg_free(msg);
		return -ENOBUFS;
	}

	return genlmsg_reply(msg, info);
2537 2538 2539 2540
}

static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
{
2541
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2542
	struct wireless_dev *wdev = info->user_ptr[1];
2543

2544 2545
	if (!rdev->ops->del_virtual_intf)
		return -EOPNOTSUPP;
2546

2547 2548 2549 2550 2551 2552 2553 2554 2555 2556
	/*
	 * If we remove a wireless device without a netdev then clear
	 * user_ptr[1] so that nl80211_post_doit won't dereference it
	 * to check if it needs to do dev_put(). Otherwise it crashes
	 * since the wdev has been freed, unlike with a netdev where
	 * we need the dev_put() for the netdev to really be freed.
	 */
	if (!wdev->netdev)
		info->user_ptr[1] = NULL;

2557
	return rdev_del_virtual_intf(rdev, wdev);
2558 2559
}

2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573
static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	u16 noack_map;

	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
		return -EINVAL;

	if (!rdev->ops->set_noack_map)
		return -EOPNOTSUPP;

	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);

2574
	return rdev_set_noack_map(rdev, dev, noack_map);
2575 2576
}

2577 2578 2579
struct get_key_cookie {
	struct sk_buff *msg;
	int error;
2580
	int idx;
2581 2582 2583 2584
};

static void get_key_callback(void *c, struct key_params *params)
{
2585
	struct nlattr *key;
2586 2587
	struct get_key_cookie *cookie = c;

2588 2589 2590 2591 2592 2593 2594 2595 2596 2597
	if ((params->key &&
	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
		     params->key_len, params->key)) ||
	    (params->seq &&
	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
		     params->seq_len, params->seq)) ||
	    (params->cipher &&
	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
			 params->cipher)))
		goto nla_put_failure;
2598

2599 2600 2601 2602
	key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
	if (!key)
		goto nla_put_failure;

2603 2604 2605 2606 2607 2608 2609 2610 2611 2612
	if ((params->key &&
	     nla_put(cookie->msg, NL80211_KEY_DATA,
		     params->key_len, params->key)) ||
	    (params->seq &&
	     nla_put(cookie->msg, NL80211_KEY_SEQ,
		     params->seq_len, params->seq)) ||
	    (params->cipher &&
	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
			 params->cipher)))
		goto nla_put_failure;
2613

2614 2615
	if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
		goto nla_put_failure;
2616 2617 2618

	nla_nest_end(cookie->msg, key);

2619 2620 2621 2622 2623 2624 2625
	return;
 nla_put_failure:
	cookie->error = 1;
}

static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
{
2626
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2627
	int err;
2628
	struct net_device *dev = info->user_ptr[1];
2629
	u8 key_idx = 0;
2630 2631
	const u8 *mac_addr = NULL;
	bool pairwise;
2632 2633 2634 2635 2636 2637 2638 2639 2640
	struct get_key_cookie cookie = {
		.error = 0,
	};
	void *hdr;
	struct sk_buff *msg;

	if (info->attrs[NL80211_ATTR_KEY_IDX])
		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);

2641
	if (key_idx > 5)
2642 2643 2644 2645 2646
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657
	pairwise = !!mac_addr;
	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
		if (kt >= NUM_NL80211_KEYTYPES)
			return -EINVAL;
		if (kt != NL80211_KEYTYPE_GROUP &&
		    kt != NL80211_KEYTYPE_PAIRWISE)
			return -EINVAL;
		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
	}

2658 2659
	if (!rdev->ops->get_key)
		return -EOPNOTSUPP;
2660

2661
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2662 2663
	if (!msg)
		return -ENOMEM;
2664

2665
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2666
			     NL80211_CMD_NEW_KEY);
2667 2668
	if (!hdr)
		return -ENOBUFS;
2669 2670

	cookie.msg = msg;
2671
	cookie.idx = key_idx;
2672

2673 2674 2675 2676 2677 2678
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
		goto nla_put_failure;
	if (mac_addr &&
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
		goto nla_put_failure;
2679

2680 2681 2682 2683
	if (pairwise && mac_addr &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
		return -ENOENT;

2684 2685
	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
			   get_key_callback);
2686 2687

	if (err)
N
Niko Jokinen 已提交
2688
		goto free_msg;
2689 2690 2691 2692 2693

	if (cookie.error)
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
2694
	return genlmsg_reply(msg, info);
2695 2696 2697

 nla_put_failure:
	err = -ENOBUFS;
N
Niko Jokinen 已提交
2698
 free_msg:
2699 2700 2701 2702 2703 2704
	nlmsg_free(msg);
	return err;
}

static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
{
2705
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2706
	struct key_parse key;
2707
	int err;
2708
	struct net_device *dev = info->user_ptr[1];
2709

2710 2711 2712
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2713

2714
	if (key.idx < 0)
2715 2716
		return -EINVAL;

2717 2718
	/* only support setting default key */
	if (!key.def && !key.defmgmt)
2719 2720
		return -EINVAL;

2721
	wdev_lock(dev->ieee80211_ptr);
2722

2723 2724 2725 2726 2727
	if (key.def) {
		if (!rdev->ops->set_default_key) {
			err = -EOPNOTSUPP;
			goto out;
		}
2728

2729 2730 2731 2732
		err = nl80211_key_allowed(dev->ieee80211_ptr);
		if (err)
			goto out;

2733
		err = rdev_set_default_key(rdev, dev, key.idx,
2734 2735 2736 2737
						 key.def_uni, key.def_multi);

		if (err)
			goto out;
J
Johannes Berg 已提交
2738

J
Johannes Berg 已提交
2739
#ifdef CONFIG_CFG80211_WEXT
2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756
		dev->ieee80211_ptr->wext.default_key = key.idx;
#endif
	} else {
		if (key.def_uni || !key.def_multi) {
			err = -EINVAL;
			goto out;
		}

		if (!rdev->ops->set_default_mgmt_key) {
			err = -EOPNOTSUPP;
			goto out;
		}

		err = nl80211_key_allowed(dev->ieee80211_ptr);
		if (err)
			goto out;

2757
		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2758 2759 2760 2761 2762
		if (err)
			goto out;

#ifdef CONFIG_CFG80211_WEXT
		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2763
#endif
2764 2765 2766
	}

 out:
J
Johannes Berg 已提交
2767
	wdev_unlock(dev->ieee80211_ptr);
2768 2769 2770 2771 2772 2773

	return err;
}

static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
{
2774
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
J
Johannes Berg 已提交
2775
	int err;
2776
	struct net_device *dev = info->user_ptr[1];
2777
	struct key_parse key;
2778
	const u8 *mac_addr = NULL;
2779

2780 2781 2782
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2783

2784
	if (!key.p.key)
2785 2786 2787 2788 2789
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2790 2791 2792 2793 2794 2795 2796 2797 2798 2799 2800 2801
	if (key.type == -1) {
		if (mac_addr)
			key.type = NL80211_KEYTYPE_PAIRWISE;
		else
			key.type = NL80211_KEYTYPE_GROUP;
	}

	/* for now */
	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
	    key.type != NL80211_KEYTYPE_GROUP)
		return -EINVAL;

2802 2803
	if (!rdev->ops->add_key)
		return -EOPNOTSUPP;
2804

2805 2806 2807
	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
					   key.type == NL80211_KEYTYPE_PAIRWISE,
					   mac_addr))
2808
		return -EINVAL;
2809

J
Johannes Berg 已提交
2810 2811 2812
	wdev_lock(dev->ieee80211_ptr);
	err = nl80211_key_allowed(dev->ieee80211_ptr);
	if (!err)
2813 2814 2815
		err = rdev_add_key(rdev, dev, key.idx,
				   key.type == NL80211_KEYTYPE_PAIRWISE,
				    mac_addr, &key.p);
J
Johannes Berg 已提交
2816
	wdev_unlock(dev->ieee80211_ptr);
2817 2818 2819 2820 2821 2822

	return err;
}

static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
{
2823
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2824
	int err;
2825
	struct net_device *dev = info->user_ptr[1];
2826
	u8 *mac_addr = NULL;
2827
	struct key_parse key;
2828

2829 2830 2831
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;
2832 2833 2834 2835

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847
	if (key.type == -1) {
		if (mac_addr)
			key.type = NL80211_KEYTYPE_PAIRWISE;
		else
			key.type = NL80211_KEYTYPE_GROUP;
	}

	/* for now */
	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
	    key.type != NL80211_KEYTYPE_GROUP)
		return -EINVAL;

2848 2849
	if (!rdev->ops->del_key)
		return -EOPNOTSUPP;
2850

J
Johannes Berg 已提交
2851 2852
	wdev_lock(dev->ieee80211_ptr);
	err = nl80211_key_allowed(dev->ieee80211_ptr);
2853 2854 2855 2856 2857

	if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
		err = -ENOENT;

J
Johannes Berg 已提交
2858
	if (!err)
2859 2860 2861
		err = rdev_del_key(rdev, dev, key.idx,
				   key.type == NL80211_KEYTYPE_PAIRWISE,
				   mac_addr);
2862

J
Johannes Berg 已提交
2863
#ifdef CONFIG_CFG80211_WEXT
2864
	if (!err) {
2865
		if (key.idx == dev->ieee80211_ptr->wext.default_key)
2866
			dev->ieee80211_ptr->wext.default_key = -1;
2867
		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2868 2869 2870
			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
	}
#endif
J
Johannes Berg 已提交
2871
	wdev_unlock(dev->ieee80211_ptr);
2872

2873 2874 2875
	return err;
}

2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966
/* This function returns an error or the number of nested attributes */
static int validate_acl_mac_addrs(struct nlattr *nl_attr)
{
	struct nlattr *attr;
	int n_entries = 0, tmp;

	nla_for_each_nested(attr, nl_attr, tmp) {
		if (nla_len(attr) != ETH_ALEN)
			return -EINVAL;

		n_entries++;
	}

	return n_entries;
}

/*
 * This function parses ACL information and allocates memory for ACL data.
 * On successful return, the calling function is responsible to free the
 * ACL buffer returned by this function.
 */
static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
						struct genl_info *info)
{
	enum nl80211_acl_policy acl_policy;
	struct nlattr *attr;
	struct cfg80211_acl_data *acl;
	int i = 0, n_entries, tmp;

	if (!wiphy->max_acl_mac_addrs)
		return ERR_PTR(-EOPNOTSUPP);

	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
		return ERR_PTR(-EINVAL);

	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
		return ERR_PTR(-EINVAL);

	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
		return ERR_PTR(-EINVAL);

	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
	if (n_entries < 0)
		return ERR_PTR(n_entries);

	if (n_entries > wiphy->max_acl_mac_addrs)
		return ERR_PTR(-ENOTSUPP);

	acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
		      GFP_KERNEL);
	if (!acl)
		return ERR_PTR(-ENOMEM);

	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
		i++;
	}

	acl->n_acl_entries = n_entries;
	acl->acl_policy = acl_policy;

	return acl;
}

static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct cfg80211_acl_data *acl;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!dev->ieee80211_ptr->beacon_interval)
		return -EINVAL;

	acl = parse_acl_data(&rdev->wiphy, info);
	if (IS_ERR(acl))
		return PTR_ERR(acl);

	err = rdev_set_mac_acl(rdev, dev, acl);

	kfree(acl);

	return err;
}

2967
static int nl80211_parse_beacon(struct nlattr *attrs[],
2968
				struct cfg80211_beacon_data *bcn)
2969
{
2970
	bool haveinfo = false;
2971

2972 2973 2974 2975
	if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2976 2977
		return -EINVAL;

2978
	memset(bcn, 0, sizeof(*bcn));
2979

2980 2981 2982
	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
2983 2984 2985
		if (!bcn->head_len)
			return -EINVAL;
		haveinfo = true;
2986 2987
	}

2988 2989 2990
	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
2991
		haveinfo = true;
2992 2993
	}

2994 2995
	if (!haveinfo)
		return -EINVAL;
J
Johannes Berg 已提交
2996

2997 2998 2999
	if (attrs[NL80211_ATTR_IE]) {
		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3000 3001
	}

3002
	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3003
		bcn->proberesp_ies =
3004
			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3005
		bcn->proberesp_ies_len =
3006
			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3007 3008
	}

3009
	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3010
		bcn->assocresp_ies =
3011
			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3012
		bcn->assocresp_ies_len =
3013
			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3014 3015
	}

3016 3017 3018
	if (attrs[NL80211_ATTR_PROBE_RESP]) {
		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3019 3020
	}

3021 3022 3023
	return 0;
}

3024 3025 3026 3027 3028 3029
static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
				   struct cfg80211_ap_settings *params)
{
	struct wireless_dev *wdev;
	bool ret = false;

3030
	list_for_each_entry(wdev, &rdev->wdev_list, list) {
3031 3032 3033 3034
		if (wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
			continue;

3035
		if (!wdev->preset_chandef.chan)
3036 3037
			continue;

3038
		params->chandef = wdev->preset_chandef;
3039 3040 3041 3042 3043 3044 3045
		ret = true;
		break;
	}

	return ret;
}

3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069
static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
				    enum nl80211_auth_type auth_type,
				    enum nl80211_commands cmd)
{
	if (auth_type > NL80211_AUTHTYPE_MAX)
		return false;

	switch (cmd) {
	case NL80211_CMD_AUTHENTICATE:
		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
		    auth_type == NL80211_AUTHTYPE_SAE)
			return false;
		return true;
	case NL80211_CMD_CONNECT:
	case NL80211_CMD_START_AP:
		/* SAE not supported yet */
		if (auth_type == NL80211_AUTHTYPE_SAE)
			return false;
		return true;
	default:
		return false;
	}
}

3070 3071 3072 3073 3074 3075 3076
static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_ap_settings params;
	int err;
3077
	u8 radar_detect_width = 0;
3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!rdev->ops->start_ap)
		return -EOPNOTSUPP;

	if (wdev->beacon_interval)
		return -EALREADY;

	memset(&params, 0, sizeof(params));

	/* these are required for START_AP */
	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
		return -EINVAL;

3097
	err = nl80211_parse_beacon(info->attrs, &params.beacon);
3098 3099 3100 3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139
	if (err)
		return err;

	params.beacon_interval =
		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
	params.dtim_period =
		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);

	err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
	if (err)
		return err;

	/*
	 * In theory, some of these attributes should be required here
	 * but since they were not used when the command was originally
	 * added, keep them optional for old user space programs to let
	 * them continue to work with drivers that do not need the
	 * additional information -- drivers must check!
	 */
	if (info->attrs[NL80211_ATTR_SSID]) {
		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
		params.ssid_len =
			nla_len(info->attrs[NL80211_ATTR_SSID]);
		if (params.ssid_len == 0 ||
		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
		params.hidden_ssid = nla_get_u32(
			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
		if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
			return -EINVAL;
	}

	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];

	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
		params.auth_type = nla_get_u32(
			info->attrs[NL80211_ATTR_AUTH_TYPE]);
3140 3141
		if (!nl80211_valid_auth_type(rdev, params.auth_type,
					     NL80211_CMD_START_AP))
3142 3143 3144 3145 3146 3147 3148 3149 3150
			return -EINVAL;
	} else
		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;

	err = nl80211_crypto_settings(rdev, info, &params.crypto,
				      NL80211_MAX_NR_CIPHER_SUITES);
	if (err)
		return err;

3151 3152 3153 3154 3155 3156 3157
	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
			return -EOPNOTSUPP;
		params.inactivity_timeout = nla_get_u16(
			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
	}

3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183
	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		params.p2p_ctwindow =
			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
		if (params.p2p_ctwindow > 127)
			return -EINVAL;
		if (params.p2p_ctwindow != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
		u8 tmp;

		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
		if (tmp > 1)
			return -EINVAL;
		params.p2p_opp_ps = tmp;
		if (params.p2p_opp_ps != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
			return -EINVAL;
	}

3184
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3185 3186 3187 3188 3189
		err = nl80211_parse_chandef(rdev, info, &params.chandef);
		if (err)
			return err;
	} else if (wdev->preset_chandef.chan) {
		params.chandef = wdev->preset_chandef;
3190
	} else if (!nl80211_get_ap_channel(rdev, &params))
3191 3192
		return -EINVAL;

3193
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3194 3195
		return -EINVAL;

3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207
	err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
	if (err < 0)
		return err;
	if (err) {
		radar_detect_width = BIT(params.chandef.width);
		params.radar_required = true;
	}

	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
					   params.chandef.chan,
					   CHAN_MODE_SHARED,
					   radar_detect_width);
3208 3209 3210
	if (err)
		return err;

3211 3212 3213 3214 3215 3216
	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
		params.acl = parse_acl_data(&rdev->wiphy, info);
		if (IS_ERR(params.acl))
			return PTR_ERR(params.acl);
	}

3217
	err = rdev_start_ap(rdev, dev, &params);
3218
	if (!err) {
3219
		wdev->preset_chandef = params.chandef;
3220
		wdev->beacon_interval = params.beacon_interval;
3221
		wdev->channel = params.chandef.chan;
3222 3223
		wdev->ssid_len = params.ssid_len;
		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3224
	}
3225 3226 3227

	kfree(params.acl);

3228
	return err;
3229 3230
}

3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248
static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_beacon_data params;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!rdev->ops->change_beacon)
		return -EOPNOTSUPP;

	if (!wdev->beacon_interval)
		return -EINVAL;

3249
	err = nl80211_parse_beacon(info->attrs, &params);
3250 3251 3252
	if (err)
		return err;

3253
	return rdev_change_beacon(rdev, dev, &params);
3254 3255 3256
}

static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3257
{
3258 3259
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3260

3261
	return cfg80211_stop_ap(rdev, dev);
3262 3263
}

3264 3265 3266 3267
static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3268
	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3269
	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3270
	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3271 3272
};

3273
static int parse_station_flags(struct genl_info *info,
3274
			       enum nl80211_iftype iftype,
3275
			       struct station_parameters *params)
3276 3277
{
	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3278
	struct nlattr *nla;
3279 3280
	int flag;

3281 3282 3283 3284 3285 3286 3287 3288 3289 3290 3291
	/*
	 * Try parsing the new attribute first so userspace
	 * can specify both for older kernels.
	 */
	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
	if (nla) {
		struct nl80211_sta_flag_update *sta_flags;

		sta_flags = nla_data(nla);
		params->sta_flags_mask = sta_flags->mask;
		params->sta_flags_set = sta_flags->set;
3292
		params->sta_flags_set &= params->sta_flags_mask;
3293 3294 3295 3296 3297 3298 3299
		if ((params->sta_flags_mask |
		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
			return -EINVAL;
		return 0;
	}

	/* if present, parse the old attribute */
3300

3301
	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3302 3303 3304 3305 3306 3307 3308
	if (!nla)
		return 0;

	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
			     nla, sta_flags_policy))
		return -EINVAL;

3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335
	/*
	 * Only allow certain flags for interface types so that
	 * other attributes are silently ignored. Remember that
	 * this is backward compatibility code with old userspace
	 * and shouldn't be hit in other cases anyway.
	 */
	switch (iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
					 BIT(NL80211_STA_FLAG_WME) |
					 BIT(NL80211_STA_FLAG_MFP);
		break;
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_STATION:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
					 BIT(NL80211_STA_FLAG_TDLS_PEER);
		break;
	case NL80211_IFTYPE_MESH_POINT:
		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
					 BIT(NL80211_STA_FLAG_MFP) |
					 BIT(NL80211_STA_FLAG_AUTHORIZED);
	default:
		return -EINVAL;
	}
3336

3337 3338
	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
		if (flags[flag]) {
3339
			params->sta_flags_set |= (1<<flag);
3340

3341 3342 3343 3344 3345 3346
			/* no longer support new API additions in old API */
			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
				return -EINVAL;
		}
	}

3347 3348 3349
	return 0;
}

3350 3351 3352 3353
static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
				 int attr)
{
	struct nlattr *rate;
3354 3355
	u32 bitrate;
	u16 bitrate_compat;
3356 3357 3358

	rate = nla_nest_start(msg, attr);
	if (!rate)
3359
		return false;
3360 3361 3362

	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
	bitrate = cfg80211_calculate_bitrate(info);
3363 3364
	/* report 16-bit bitrate only if we can */
	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3365 3366 3367 3368 3369 3370 3371 3372 3373 3374 3375 3376 3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387 3388 3389 3390 3391 3392 3393 3394 3395 3396 3397 3398 3399 3400 3401
	if (bitrate > 0 &&
	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
		return false;
	if (bitrate_compat > 0 &&
	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
		return false;

	if (info->flags & RATE_INFO_FLAGS_MCS) {
		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
			return false;
		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
			return false;
	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
			return false;
		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
			return false;
		if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
		    nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
			return false;
		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
			return false;
	}
3402 3403 3404 3405 3406

	nla_nest_end(msg, rate);
	return true;
}

3407 3408 3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432
static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
			       int id)
{
	void *attr;
	int i = 0;

	if (!mask)
		return true;

	attr = nla_nest_start(msg, id);
	if (!attr)
		return false;

	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
		if (!(mask & BIT(i)))
			continue;

		if (nla_put_u8(msg, i, signal[i]))
			return false;
	}

	nla_nest_end(msg, attr);

	return true;
}

3433
static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3434 3435 3436
				int flags,
				struct cfg80211_registered_device *rdev,
				struct net_device *dev,
3437
				const u8 *mac_addr, struct station_info *sinfo)
3438 3439
{
	void *hdr;
3440
	struct nlattr *sinfoattr, *bss_param;
3441

3442
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3443 3444 3445
	if (!hdr)
		return -1;

3446 3447 3448 3449
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
		goto nla_put_failure;
3450

3451 3452
	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
	if (!sinfoattr)
3453
		goto nla_put_failure;
3454 3455 3456 3457 3458 3459 3460 3461
	if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
	    nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
			sinfo->connected_time))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
	    nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
			sinfo->inactive_time))
		goto nla_put_failure;
3462 3463
	if ((sinfo->filled & (STATION_INFO_RX_BYTES |
			      STATION_INFO_RX_BYTES64)) &&
3464
	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3465
			(u32)sinfo->rx_bytes))
3466
		goto nla_put_failure;
3467
	if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3468
			      STATION_INFO_TX_BYTES64)) &&
3469
	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3470 3471 3472 3473 3474 3475 3476 3477
			(u32)sinfo->tx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
	    nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
			sinfo->rx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
	    nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3478 3479 3480 3481 3482 3483 3484 3485 3486 3487 3488 3489
			sinfo->tx_bytes))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_LLID) &&
	    nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PLID) &&
	    nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
	    nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
		       sinfo->plink_state))
		goto nla_put_failure;
3490 3491
	switch (rdev->wiphy.signal_type) {
	case CFG80211_SIGNAL_TYPE_MBM:
3492 3493 3494 3495 3496 3497 3498 3499
		if ((sinfo->filled & STATION_INFO_SIGNAL) &&
		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
			       sinfo->signal))
			goto nla_put_failure;
		if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
		    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
			       sinfo->signal_avg))
			goto nla_put_failure;
3500 3501 3502 3503
		break;
	default:
		break;
	}
3504 3505 3506 3507 3508 3509 3510 3511 3512 3513 3514 3515
	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
		if (!nl80211_put_signal(msg, sinfo->chains,
					sinfo->chain_signal,
					NL80211_STA_INFO_CHAIN_SIGNAL))
			goto nla_put_failure;
	}
	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
		if (!nl80211_put_signal(msg, sinfo->chains,
					sinfo->chain_signal_avg,
					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
			goto nla_put_failure;
	}
3516
	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3517 3518 3519 3520 3521 3522 3523
		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
					  NL80211_STA_INFO_TX_BITRATE))
			goto nla_put_failure;
	}
	if (sinfo->filled & STATION_INFO_RX_BITRATE) {
		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
					  NL80211_STA_INFO_RX_BITRATE))
3524 3525
			goto nla_put_failure;
	}
3526 3527 3528 3529 3530 3531 3532 3533 3534 3535 3536 3537 3538 3539 3540 3541 3542 3543 3544 3545
	if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
	    nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
			sinfo->rx_packets))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
			sinfo->tx_packets))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
			sinfo->tx_retries))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
	    nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
			sinfo->tx_failed))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
	    nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
			sinfo->beacon_loss_count))
		goto nla_put_failure;
3546 3547 3548 3549 3550 3551 3552 3553 3554 3555 3556 3557
	if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
			sinfo->local_pm))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_PEER_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
			sinfo->peer_pm))
		goto nla_put_failure;
	if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
	    nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
			sinfo->nonpeer_pm))
		goto nla_put_failure;
3558 3559 3560 3561 3562
	if (sinfo->filled & STATION_INFO_BSS_PARAM) {
		bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
		if (!bss_param)
			goto nla_put_failure;

3563 3564 3565 3566 3567 3568 3569 3570 3571 3572 3573
		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
			       sinfo->bss_param.dtim_period) ||
		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
				sinfo->bss_param.beacon_interval))
			goto nla_put_failure;
3574 3575 3576

		nla_nest_end(msg, bss_param);
	}
3577 3578 3579 3580 3581
	if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
		    sizeof(struct nl80211_sta_flag_update),
		    &sinfo->sta_flags))
		goto nla_put_failure;
3582 3583 3584 3585
	if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
		nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
			    sinfo->t_offset))
		goto nla_put_failure;
3586
	nla_nest_end(msg, sinfoattr);
3587

3588 3589 3590 3591
	if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
		    sinfo->assoc_req_ies))
		goto nla_put_failure;
3592

3593 3594 3595
	return genlmsg_end(msg, hdr);

 nla_put_failure:
3596 3597
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
3598 3599
}

3600
static int nl80211_dump_station(struct sk_buff *skb,
J
Johannes Berg 已提交
3601
				struct netlink_callback *cb)
3602 3603 3604
{
	struct station_info sinfo;
	struct cfg80211_registered_device *dev;
3605
	struct wireless_dev *wdev;
3606
	u8 mac_addr[ETH_ALEN];
3607
	int sta_idx = cb->args[2];
3608 3609
	int err;

3610
	err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3611 3612
	if (err)
		return err;
J
Johannes Berg 已提交
3613

3614 3615 3616 3617 3618
	if (!wdev->netdev) {
		err = -EINVAL;
		goto out_err;
	}

J
Johannes Berg 已提交
3619
	if (!dev->ops->dump_station) {
3620
		err = -EOPNOTSUPP;
J
Johannes Berg 已提交
3621 3622 3623 3624
		goto out_err;
	}

	while (1) {
3625
		memset(&sinfo, 0, sizeof(sinfo));
3626
		err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3627
					mac_addr, &sinfo);
J
Johannes Berg 已提交
3628 3629 3630
		if (err == -ENOENT)
			break;
		if (err)
J
Johannes Berg 已提交
3631
			goto out_err;
J
Johannes Berg 已提交
3632 3633

		if (nl80211_send_station(skb,
3634
				NETLINK_CB(cb->skb).portid,
J
Johannes Berg 已提交
3635
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
3636
				dev, wdev->netdev, mac_addr,
J
Johannes Berg 已提交
3637 3638 3639 3640 3641 3642 3643 3644
				&sinfo) < 0)
			goto out;

		sta_idx++;
	}


 out:
3645
	cb->args[2] = sta_idx;
J
Johannes Berg 已提交
3646 3647
	err = skb->len;
 out_err:
3648
	nl80211_finish_wdev_dump(dev);
J
Johannes Berg 已提交
3649 3650

	return err;
3651
}
3652

3653 3654
static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
{
3655 3656
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3657
	struct station_info sinfo;
3658 3659
	struct sk_buff *msg;
	u8 *mac_addr = NULL;
3660
	int err;
3661

3662
	memset(&sinfo, 0, sizeof(sinfo));
3663 3664 3665 3666 3667 3668

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

3669 3670
	if (!rdev->ops->get_station)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
3671

3672
	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3673
	if (err)
3674
		return err;
3675

3676
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3677
	if (!msg)
3678
		return -ENOMEM;
3679

3680
	if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3681
				 rdev, dev, mac_addr, &sinfo) < 0) {
3682 3683 3684
		nlmsg_free(msg);
		return -ENOBUFS;
	}
J
Johannes Berg 已提交
3685

3686
	return genlmsg_reply(msg, info);
3687 3688
}

3689 3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701
int cfg80211_check_station_change(struct wiphy *wiphy,
				  struct station_parameters *params,
				  enum cfg80211_station_type statype)
{
	if (params->listen_interval != -1)
		return -EINVAL;
	if (params->aid)
		return -EINVAL;

	/* When you run into this, adjust the code below for the new flag */
	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);

	switch (statype) {
3702 3703
	case CFG80211_STA_MESH_PEER_KERNEL:
	case CFG80211_STA_MESH_PEER_USER:
3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804
		/*
		 * No ignoring the TDLS flag here -- the userspace mesh
		 * code doesn't have the bug of including TDLS in the
		 * mask everywhere.
		 */
		if (params->sta_flags_mask &
				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				  BIT(NL80211_STA_FLAG_MFP) |
				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_SETUP:
	case CFG80211_STA_TDLS_PEER_ACTIVE:
		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
			return -EINVAL;
		/* ignore since it can't change */
		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
		break;
	default:
		/* disallow mesh-specific things */
		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
			return -EINVAL;
		if (params->local_pm)
			return -EINVAL;
		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
			return -EINVAL;
	}

	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
		/* TDLS can't be set, ... */
		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
			return -EINVAL;
		/*
		 * ... but don't bother the driver with it. This works around
		 * a hostapd/wpa_supplicant issue -- it always includes the
		 * TLDS_PEER flag in the mask even for AP mode.
		 */
		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
	}

	if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
		/* reject other things that can't change */
		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
			return -EINVAL;
		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
			return -EINVAL;
		if (params->supported_rates)
			return -EINVAL;
		if (params->ext_capab || params->ht_capa || params->vht_capa)
			return -EINVAL;
	}

	if (statype != CFG80211_STA_AP_CLIENT) {
		if (params->vlan)
			return -EINVAL;
	}

	switch (statype) {
	case CFG80211_STA_AP_MLME_CLIENT:
		/* Use this only for authorizing/unauthorizing a station */
		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
			return -EOPNOTSUPP;
		break;
	case CFG80211_STA_AP_CLIENT:
		/* accept only the listed bits */
		if (params->sta_flags_mask &
				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
				  BIT(NL80211_STA_FLAG_WME) |
				  BIT(NL80211_STA_FLAG_MFP)))
			return -EINVAL;

		/* but authenticated/associated only if driver handles it */
		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
		    params->sta_flags_mask &
				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
			return -EINVAL;
		break;
	case CFG80211_STA_IBSS:
	case CFG80211_STA_AP_STA:
		/* reject any changes other than AUTHORIZED */
		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_SETUP:
		/* reject any changes other than AUTHORIZED or WME */
		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
					       BIT(NL80211_STA_FLAG_WME)))
			return -EINVAL;
		/* force (at least) rates when authorizing */
		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
		    !params->supported_rates)
			return -EINVAL;
		break;
	case CFG80211_STA_TDLS_PEER_ACTIVE:
		/* reject any changes */
		return -EINVAL;
3805
	case CFG80211_STA_MESH_PEER_KERNEL:
3806 3807 3808
		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
			return -EINVAL;
		break;
3809
	case CFG80211_STA_MESH_PEER_USER:
3810 3811 3812 3813 3814 3815 3816 3817 3818
		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
			return -EINVAL;
		break;
	}

	return 0;
}
EXPORT_SYMBOL(cfg80211_check_station_change);

3819
/*
3820
 * Get vlan interface making sure it is running and on the right wiphy.
3821
 */
3822 3823
static struct net_device *get_vlan(struct genl_info *info,
				   struct cfg80211_registered_device *rdev)
3824
{
3825
	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838
	struct net_device *v;
	int ret;

	if (!vlanattr)
		return NULL;

	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
	if (!v)
		return ERR_PTR(-ENODEV);

	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
		ret = -EINVAL;
		goto error;
3839
	}
3840

3841 3842 3843 3844 3845 3846 3847
	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
		ret = -EINVAL;
		goto error;
	}

3848 3849 3850 3851 3852 3853 3854 3855 3856
	if (!netif_running(v)) {
		ret = -ENETDOWN;
		goto error;
	}

	return v;
 error:
	dev_put(v);
	return ERR_PTR(ret);
3857 3858
}

3859 3860 3861 3862 3863 3864
static struct nla_policy
nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
};

3865 3866
static int nl80211_parse_sta_wme(struct genl_info *info,
				 struct station_parameters *params)
3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898
{
	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
	struct nlattr *nla;
	int err;

	/* parse WME attributes if present */
	if (!info->attrs[NL80211_ATTR_STA_WME])
		return 0;

	nla = info->attrs[NL80211_ATTR_STA_WME];
	err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
			       nl80211_sta_wme_policy);
	if (err)
		return err;

	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
		params->uapsd_queues = nla_get_u8(
			tb[NL80211_STA_WME_UAPSD_QUEUES]);
	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
		return -EINVAL;

	if (tb[NL80211_STA_WME_MAX_SP])
		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);

	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
		return -EINVAL;

	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;

	return 0;
}

3899 3900 3901 3902
static int nl80211_set_station_tdls(struct genl_info *info,
				    struct station_parameters *params)
{
	/* Dummy STA entry gets updated once the peer capabilities are known */
3903 3904
	if (info->attrs[NL80211_ATTR_PEER_AID])
		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3905 3906 3907 3908 3909 3910 3911 3912 3913 3914
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
		params->ht_capa =
			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
		params->vht_capa =
			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);

	return nl80211_parse_sta_wme(info, params);
}

3915 3916
static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
{
3917 3918
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
3919
	struct station_parameters params;
3920 3921
	u8 *mac_addr;
	int err;
3922 3923 3924 3925 3926

	memset(&params, 0, sizeof(params));

	params.listen_interval = -1;

3927 3928 3929
	if (!rdev->ops->change_station)
		return -EOPNOTSUPP;

3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944
	if (info->attrs[NL80211_ATTR_STA_AID])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
		params.supported_rates =
			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
		params.supported_rates_len =
			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	}

3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957
	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
		params.capability =
			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
	}

	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
		params.ext_capab =
			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
		params.ext_capab_len =
			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
	}

3958
	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3959
		return -EINVAL;
3960

3961
	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3962 3963
		return -EINVAL;

3964
	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3965
		params.plink_action =
3966 3967 3968 3969
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
			return -EINVAL;
	}
3970

3971
	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3972
		params.plink_state =
3973 3974 3975 3976 3977
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
		if (params.plink_state >= NUM_NL80211_PLINK_STATES)
			return -EINVAL;
		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
	}
3978

3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989
	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
		enum nl80211_mesh_power_mode pm = nla_get_u32(
			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);

		if (pm <= NL80211_MESH_POWER_UNKNOWN ||
		    pm > NL80211_MESH_POWER_MAX)
			return -EINVAL;

		params.local_pm = pm;
	}

3990 3991 3992 3993 3994 3995 3996 3997 3998
	/* Include parameters for TDLS peer (will check later) */
	err = nl80211_set_station_tdls(info, &params);
	if (err)
		return err;

	params.vlan = get_vlan(info, rdev);
	if (IS_ERR(params.vlan))
		return PTR_ERR(params.vlan);

3999 4000 4001
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
4002 4003
	case NL80211_IFTYPE_P2P_GO:
	case NL80211_IFTYPE_P2P_CLIENT:
4004
	case NL80211_IFTYPE_STATION:
4005
	case NL80211_IFTYPE_ADHOC:
4006 4007 4008
	case NL80211_IFTYPE_MESH_POINT:
		break;
	default:
4009 4010
		err = -EOPNOTSUPP;
		goto out_put_vlan;
4011 4012
	}

4013
	/* driver will call cfg80211_check_station_change() */
4014
	err = rdev_change_station(rdev, dev, mac_addr, &params);
4015

4016
 out_put_vlan:
4017 4018
	if (params.vlan)
		dev_put(params.vlan);
J
Johannes Berg 已提交
4019

4020 4021 4022 4023 4024
	return err;
}

static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
{
4025
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4026
	int err;
4027
	struct net_device *dev = info->user_ptr[1];
4028 4029 4030 4031 4032
	struct station_parameters params;
	u8 *mac_addr = NULL;

	memset(&params, 0, sizeof(params));

4033 4034 4035
	if (!rdev->ops->add_station)
		return -EOPNOTSUPP;

4036 4037 4038 4039 4040 4041 4042 4043 4044
	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
		return -EINVAL;

4045 4046
	if (!info->attrs[NL80211_ATTR_STA_AID] &&
	    !info->attrs[NL80211_ATTR_PEER_AID])
4047 4048
		return -EINVAL;

4049 4050 4051 4052 4053 4054 4055
	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
	params.supported_rates =
		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	params.supported_rates_len =
		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
	params.listen_interval =
		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4056

4057
	if (info->attrs[NL80211_ATTR_PEER_AID])
4058
		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4059 4060
	else
		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4061 4062
	if (!params.aid || params.aid > IEEE80211_MAX_AID)
		return -EINVAL;
4063

4064 4065 4066 4067 4068 4069 4070 4071 4072 4073 4074 4075 4076
	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
		params.capability =
			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
	}

	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
		params.ext_capab =
			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
		params.ext_capab_len =
			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
	}

4077 4078 4079
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
		params.ht_capa =
			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4080

M
Mahesh Palivela 已提交
4081 4082 4083 4084
	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
		params.vht_capa =
			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);

4085
	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4086
		params.plink_action =
4087 4088 4089 4090
			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
			return -EINVAL;
	}
4091

4092 4093 4094
	err = nl80211_parse_sta_wme(info, &params);
	if (err)
		return err;
4095

4096
	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4097 4098
		return -EINVAL;

4099 4100 4101
	/* When you run into this, adjust the code below for the new flag */
	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);

4102 4103 4104 4105
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
4106 4107 4108 4109
		/* ignore WME attributes if iface/sta is not capable */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4110

4111
		/* TDLS peers cannot be added */
4112 4113
		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
		    info->attrs[NL80211_ATTR_PEER_AID])
4114
			return -EINVAL;
4115 4116
		/* but don't bother the driver with it */
		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4117

4118 4119 4120 4121 4122 4123 4124 4125
		/* allow authenticated/associated only if driver handles it */
		if (!(rdev->wiphy.features &
				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
		    params.sta_flags_mask &
				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
			return -EINVAL;

4126 4127 4128 4129 4130 4131
		/* must be last in here for error handling */
		params.vlan = get_vlan(info, rdev);
		if (IS_ERR(params.vlan))
			return PTR_ERR(params.vlan);
		break;
	case NL80211_IFTYPE_MESH_POINT:
4132 4133 4134
		/* ignore uAPSD data */
		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;

4135 4136 4137
		/* associated is disallowed */
		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
			return -EINVAL;
4138
		/* TDLS peers cannot be added */
4139 4140
		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
		    info->attrs[NL80211_ATTR_PEER_AID])
4141 4142 4143
			return -EINVAL;
		break;
	case NL80211_IFTYPE_STATION:
4144
	case NL80211_IFTYPE_P2P_CLIENT:
4145 4146 4147
		/* ignore uAPSD data */
		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;

4148 4149 4150 4151
		/* these are disallowed */
		if (params.sta_flags_mask &
				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4152
			return -EINVAL;
4153 4154 4155 4156 4157 4158 4159 4160 4161
		/* Only TDLS peers can be added */
		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
			return -EINVAL;
		/* Can only add if TDLS ... */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
			return -EOPNOTSUPP;
		/* ... with external setup is supported */
		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
			return -EOPNOTSUPP;
4162 4163 4164 4165 4166
		/*
		 * Older wpa_supplicant versions always mark the TDLS peer
		 * as authorized, but it shouldn't yet be.
		 */
		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4167 4168 4169
		break;
	default:
		return -EOPNOTSUPP;
4170 4171
	}

4172
	/* be aware of params.vlan when changing code here */
4173

4174
	err = rdev_add_station(rdev, dev, mac_addr, &params);
4175 4176 4177 4178 4179 4180 4181 4182

	if (params.vlan)
		dev_put(params.vlan);
	return err;
}

static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
{
4183 4184
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4185 4186 4187 4188 4189
	u8 *mac_addr = NULL;

	if (info->attrs[NL80211_ATTR_MAC])
		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

4190
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4191
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4192
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4193 4194
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EINVAL;
4195

4196 4197
	if (!rdev->ops->del_station)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4198

4199
	return rdev_del_station(rdev, dev, mac_addr);
4200 4201
}

4202
static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4203 4204 4205 4206 4207 4208 4209
				int flags, struct net_device *dev,
				u8 *dst, u8 *next_hop,
				struct mpath_info *pinfo)
{
	void *hdr;
	struct nlattr *pinfoattr;

4210
	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4211 4212 4213
	if (!hdr)
		return -1;

4214 4215 4216 4217 4218
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
		goto nla_put_failure;
4219

4220 4221 4222
	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
	if (!pinfoattr)
		goto nla_put_failure;
4223 4224 4225 4226 4227 4228 4229 4230 4231 4232 4233 4234 4235 4236 4237 4238 4239 4240 4241 4242 4243 4244
	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
			pinfo->frame_qlen))
		goto nla_put_failure;
	if (((pinfo->filled & MPATH_INFO_SN) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
	    ((pinfo->filled & MPATH_INFO_METRIC) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
			 pinfo->metric)) ||
	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
			 pinfo->exptime)) ||
	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
			pinfo->flags)) ||
	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
			 pinfo->discovery_timeout)) ||
	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
			pinfo->discovery_retries)))
		goto nla_put_failure;
4245 4246 4247 4248 4249 4250

	nla_nest_end(msg, pinfoattr);

	return genlmsg_end(msg, hdr);

 nla_put_failure:
4251 4252
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
4253 4254 4255
}

static int nl80211_dump_mpath(struct sk_buff *skb,
J
Johannes Berg 已提交
4256
			      struct netlink_callback *cb)
4257 4258 4259
{
	struct mpath_info pinfo;
	struct cfg80211_registered_device *dev;
4260
	struct wireless_dev *wdev;
4261 4262
	u8 dst[ETH_ALEN];
	u8 next_hop[ETH_ALEN];
4263
	int path_idx = cb->args[2];
4264 4265
	int err;

4266
	err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4267 4268
	if (err)
		return err;
J
Johannes Berg 已提交
4269 4270

	if (!dev->ops->dump_mpath) {
4271
		err = -EOPNOTSUPP;
J
Johannes Berg 已提交
4272 4273 4274
		goto out_err;
	}

4275
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4276
		err = -EOPNOTSUPP;
4277
		goto out_err;
4278 4279
	}

J
Johannes Berg 已提交
4280
	while (1) {
4281 4282
		err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
				      next_hop, &pinfo);
J
Johannes Berg 已提交
4283
		if (err == -ENOENT)
4284
			break;
J
Johannes Berg 已提交
4285
		if (err)
J
Johannes Berg 已提交
4286
			goto out_err;
4287

4288
		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
J
Johannes Berg 已提交
4289
				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
4290
				       wdev->netdev, dst, next_hop,
J
Johannes Berg 已提交
4291 4292
				       &pinfo) < 0)
			goto out;
4293

J
Johannes Berg 已提交
4294
		path_idx++;
4295 4296 4297
	}


J
Johannes Berg 已提交
4298
 out:
4299
	cb->args[2] = path_idx;
J
Johannes Berg 已提交
4300 4301
	err = skb->len;
 out_err:
4302
	nl80211_finish_wdev_dump(dev);
J
Johannes Berg 已提交
4303
	return err;
4304 4305 4306 4307
}

static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
{
4308
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4309
	int err;
4310
	struct net_device *dev = info->user_ptr[1];
4311 4312 4313 4314 4315 4316 4317 4318 4319 4320 4321 4322
	struct mpath_info pinfo;
	struct sk_buff *msg;
	u8 *dst = NULL;
	u8 next_hop[ETH_ALEN];

	memset(&pinfo, 0, sizeof(pinfo));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

4323 4324
	if (!rdev->ops->get_mpath)
		return -EOPNOTSUPP;
4325

4326 4327
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4328

4329
	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4330
	if (err)
4331
		return err;
4332

4333
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4334
	if (!msg)
4335
		return -ENOMEM;
4336

4337
	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4338 4339 4340 4341
				 dev, dst, next_hop, &pinfo) < 0) {
		nlmsg_free(msg);
		return -ENOBUFS;
	}
J
Johannes Berg 已提交
4342

4343
	return genlmsg_reply(msg, info);
4344 4345 4346 4347
}

static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
{
4348 4349
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4350 4351 4352 4353 4354 4355 4356 4357 4358 4359 4360 4361
	u8 *dst = NULL;
	u8 *next_hop = NULL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);

4362 4363
	if (!rdev->ops->change_mpath)
		return -EOPNOTSUPP;
4364

4365 4366
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4367

4368
	return rdev_change_mpath(rdev, dev, dst, next_hop);
4369
}
4370

4371 4372
static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
{
4373 4374
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4375 4376 4377 4378 4379 4380 4381 4382 4383 4384 4385 4386
	u8 *dst = NULL;
	u8 *next_hop = NULL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
		return -EINVAL;

	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);

4387 4388
	if (!rdev->ops->add_mpath)
		return -EOPNOTSUPP;
4389

4390 4391
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;
4392

4393
	return rdev_add_mpath(rdev, dev, dst, next_hop);
4394 4395 4396 4397
}

static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
{
4398 4399
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4400 4401 4402 4403 4404
	u8 *dst = NULL;

	if (info->attrs[NL80211_ATTR_MAC])
		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);

4405 4406
	if (!rdev->ops->del_mpath)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4407

4408
	return rdev_del_mpath(rdev, dev, dst);
4409 4410
}

4411 4412
static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
{
4413 4414
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4415 4416 4417 4418 4419 4420 4421
	struct bss_parameters params;

	memset(&params, 0, sizeof(params));
	/* default to not changing parameters */
	params.use_cts_prot = -1;
	params.use_short_preamble = -1;
	params.use_short_slot_time = -1;
4422
	params.ap_isolate = -1;
4423
	params.ht_opmode = -1;
4424 4425
	params.p2p_ctwindow = -1;
	params.p2p_opp_ps = -1;
4426 4427 4428 4429 4430 4431 4432 4433 4434 4435

	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
		params.use_cts_prot =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
		params.use_short_preamble =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
		params.use_short_slot_time =
		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4436 4437 4438 4439 4440 4441
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		params.basic_rates =
			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		params.basic_rates_len =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
	}
4442 4443
	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4444 4445 4446
	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
		params.ht_opmode =
			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4447

4448 4449 4450 4451 4452 4453 4454 4455 4456 4457 4458 4459 4460 4461 4462 4463 4464 4465 4466 4467 4468 4469 4470 4471 4472 4473
	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		params.p2p_ctwindow =
			nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
		if (params.p2p_ctwindow < 0)
			return -EINVAL;
		if (params.p2p_ctwindow != 0 &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
		u8 tmp;

		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
			return -EINVAL;
		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
		if (tmp > 1)
			return -EINVAL;
		params.p2p_opp_ps = tmp;
		if (params.p2p_opp_ps &&
		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
			return -EINVAL;
	}

4474 4475
	if (!rdev->ops->change_bss)
		return -EOPNOTSUPP;
4476

4477
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4478 4479
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
4480

4481
	return rdev_change_bss(rdev, dev, &params);
4482 4483
}

A
Alexey Dobriyan 已提交
4484
static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4485 4486 4487 4488 4489 4490 4491 4492 4493 4494 4495 4496 4497 4498 4499 4500 4501 4502 4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532
	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
};

static int parse_reg_rule(struct nlattr *tb[],
	struct ieee80211_reg_rule *reg_rule)
{
	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;

	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
		return -EINVAL;
	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
		return -EINVAL;
	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
		return -EINVAL;

	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);

	freq_range->start_freq_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
	freq_range->end_freq_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
	freq_range->max_bandwidth_khz =
		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);

	power_rule->max_eirp =
		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);

	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
		power_rule->max_antenna_gain =
			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);

	return 0;
}

static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
{
	int r;
	char *data = NULL;
4533
	enum nl80211_user_reg_hint_type user_reg_hint_type;
4534

4535 4536 4537 4538 4539 4540
	/*
	 * You should only get this when cfg80211 hasn't yet initialized
	 * completely when built-in to the kernel right between the time
	 * window between nl80211_init() and regulatory_init(), if that is
	 * even possible.
	 */
4541
	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4542
		return -EINPROGRESS;
4543

4544 4545
	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
		return -EINVAL;
4546 4547 4548

	data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);

4549 4550 4551 4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563
	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
		user_reg_hint_type =
		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
	else
		user_reg_hint_type = NL80211_USER_REG_HINT_USER;

	switch (user_reg_hint_type) {
	case NL80211_USER_REG_HINT_USER:
	case NL80211_USER_REG_HINT_CELL_BASE:
		break;
	default:
		return -EINVAL;
	}

	r = regulatory_hint_user(data, user_reg_hint_type);
4564

4565 4566 4567
	return r;
}

4568
static int nl80211_get_mesh_config(struct sk_buff *skb,
4569
				   struct genl_info *info)
4570
{
4571 4572
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4573 4574 4575
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct mesh_config cur_params;
	int err = 0;
4576 4577 4578 4579
	void *hdr;
	struct nlattr *pinfoattr;
	struct sk_buff *msg;

4580 4581 4582
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

4583
	if (!rdev->ops->get_mesh_config)
4584
		return -EOPNOTSUPP;
4585

4586 4587 4588 4589 4590
	wdev_lock(wdev);
	/* If not connected, get default parameters */
	if (!wdev->mesh_id_len)
		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
	else
4591
		err = rdev_get_mesh_config(rdev, dev, &cur_params);
4592 4593
	wdev_unlock(wdev);

4594
	if (err)
4595
		return err;
4596 4597

	/* Draw up a netlink message to send back */
4598
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4599 4600
	if (!msg)
		return -ENOMEM;
4601
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4602
			     NL80211_CMD_GET_MESH_CONFIG);
4603
	if (!hdr)
4604
		goto out;
4605
	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4606 4607
	if (!pinfoattr)
		goto nla_put_failure;
4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620 4621 4622 4623 4624
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
			cur_params.dot11MeshRetryTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
			cur_params.dot11MeshConfirmTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
			cur_params.dot11MeshHoldingTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
			cur_params.dot11MeshMaxPeerLinks) ||
	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
		       cur_params.dot11MeshMaxRetries) ||
	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
		       cur_params.dot11MeshTTL) ||
	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
		       cur_params.element_ttl) ||
	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
		       cur_params.auto_open_plinks) ||
4625 4626
	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4627 4628 4629 4630 4631 4632 4633 4634 4635 4636 4637 4638 4639 4640 4641 4642 4643 4644 4645 4646 4647 4648 4649
	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
		       cur_params.dot11MeshHWMPmaxPREQretries) ||
	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
			cur_params.path_refresh_time) ||
	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
			cur_params.min_discovery_timeout) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
			cur_params.dot11MeshHWMPactivePathTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
			cur_params.dot11MeshHWMPpreqMinInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
			cur_params.dot11MeshHWMPperrMinInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
		       cur_params.dot11MeshHWMPRootMode) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
			cur_params.dot11MeshHWMPRannInterval) ||
	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
		       cur_params.dot11MeshGateAnnouncementProtocol) ||
	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
		       cur_params.dot11MeshForwarding) ||
	    nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4650 4651
			cur_params.rssi_threshold) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4652 4653 4654 4655
			cur_params.ht_opmode) ||
	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4656 4657
			cur_params.dot11MeshHWMProotInterval) ||
	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4658 4659 4660 4661
			cur_params.dot11MeshHWMPconfirmationInterval) ||
	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
			cur_params.power_mode) ||
	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4662 4663 4664
			cur_params.dot11MeshAwakeWindowDuration) ||
	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
			cur_params.plink_timeout))
4665
		goto nla_put_failure;
4666 4667
	nla_nest_end(msg, pinfoattr);
	genlmsg_end(msg, hdr);
4668
	return genlmsg_reply(msg, info);
4669

J
Johannes Berg 已提交
4670
 nla_put_failure:
4671
	genlmsg_cancel(msg, hdr);
4672
 out:
Y
Yuri Ershov 已提交
4673
	nlmsg_free(msg);
4674
	return -ENOBUFS;
4675 4676
}

A
Alexey Dobriyan 已提交
4677
static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4678 4679 4680 4681 4682 4683
	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4684
	[NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4685
	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4686
	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4687 4688 4689 4690 4691
	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4692
	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4693
	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4694
	[NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4695
	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4696
	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4697
	[NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4698 4699
	[NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4700 4701
	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4702
	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4703 4704
	[NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4705
	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4706 4707
};

4708 4709
static const struct nla_policy
	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4710
	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4711 4712
	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4713
	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4714
	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4715
	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4716
	[NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4717
				    .len = IEEE80211_MAX_DATA_LEN },
4718
	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4719 4720
};

4721
static int nl80211_parse_mesh_config(struct genl_info *info,
4722 4723
				     struct mesh_config *cfg,
				     u32 *mask_out)
4724 4725
{
	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4726
	u32 mask = 0;
4727

4728 4729 4730 4731 4732 4733 4734 4735 4736
#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
do {									    \
	if (tb[attr]) {							    \
		if (fn(tb[attr]) < min || fn(tb[attr]) > max)		    \
			return -EINVAL;					    \
		cfg->param = fn(tb[attr]);				    \
		mask |= (1 << (attr - 1));				    \
	}								    \
} while (0)
4737 4738


4739
	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4740 4741
		return -EINVAL;
	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4742
			     info->attrs[NL80211_ATTR_MESH_CONFIG],
4743
			     nl80211_meshconf_params_policy))
4744 4745 4746 4747 4748 4749 4750
		return -EINVAL;

	/* This makes sure that there aren't more than 32 mesh config
	 * parameters (otherwise our bitfield scheme would not work.) */
	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);

	/* Fill in the params struct */
4751
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4752 4753
				  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
				  nla_get_u16);
4754
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4755 4756
				  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
				  nla_get_u16);
4757
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4758 4759
				  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
				  nla_get_u16);
4760
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4761 4762
				  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
				  nla_get_u16);
4763
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4764 4765
				  mask, NL80211_MESHCONF_MAX_RETRIES,
				  nla_get_u8);
4766
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4767
				  mask, NL80211_MESHCONF_TTL, nla_get_u8);
4768
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4769 4770
				  mask, NL80211_MESHCONF_ELEMENT_TTL,
				  nla_get_u8);
4771
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4772 4773
				  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
				  nla_get_u8);
4774 4775
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
				  1, 255, mask,
4776 4777
				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
				  nla_get_u32);
4778
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4779 4780
				  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
				  nla_get_u8);
4781
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4782 4783
				  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
				  nla_get_u32);
4784
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4785 4786
				  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
				  nla_get_u16);
4787 4788
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
				  1, 65535, mask,
4789 4790
				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
				  nla_get_u32);
4791
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4792 4793
				  1, 65535, mask,
				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4794
				  nla_get_u16);
4795
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4796 4797
				  1, 65535, mask,
				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4798
				  nla_get_u16);
4799
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4800 4801
				  dot11MeshHWMPnetDiameterTraversalTime,
				  1, 65535, mask,
4802 4803
				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
				  nla_get_u16);
4804 4805 4806 4807 4808
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
				  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
				  nla_get_u8);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
				  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4809
				  nla_get_u16);
4810
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4811 4812
				  dot11MeshGateAnnouncementProtocol, 0, 1,
				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4813
				  nla_get_u8);
4814
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4815 4816
				  mask, NL80211_MESHCONF_FORWARDING,
				  nla_get_u8);
4817
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4818
				  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4819
				  nla_get_s32);
4820
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4821
				  mask, NL80211_MESHCONF_HT_OPMODE,
4822 4823
				  nla_get_u16);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4824
				  1, 65535, mask,
4825 4826
				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
				  nla_get_u32);
4827
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4828
				  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4829 4830
				  nla_get_u16);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4831 4832
				  dot11MeshHWMPconfirmationInterval,
				  1, 65535, mask,
4833
				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4834
				  nla_get_u16);
4835 4836 4837 4838 4839 4840 4841 4842
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
				  NL80211_MESH_POWER_ACTIVE,
				  NL80211_MESH_POWER_MAX,
				  mask, NL80211_MESHCONF_POWER_MODE,
				  nla_get_u32);
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
				  0, 65535, mask,
				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4843 4844 4845
	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
				  mask, NL80211_MESHCONF_PLINK_TIMEOUT,
				  nla_get_u32);
4846 4847
	if (mask_out)
		*mask_out = mask;
4848

4849 4850 4851 4852 4853
	return 0;

#undef FILL_IN_MESH_PARAM_IF_SET
}

4854 4855 4856
static int nl80211_parse_mesh_setup(struct genl_info *info,
				     struct mesh_setup *setup)
{
4857
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4858 4859 4860 4861 4862 4863 4864 4865 4866
	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];

	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
		return -EINVAL;
	if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
			     info->attrs[NL80211_ATTR_MESH_SETUP],
			     nl80211_mesh_setup_params_policy))
		return -EINVAL;

4867 4868 4869 4870 4871 4872
	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
		setup->sync_method =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
		 IEEE80211_SYNC_METHOD_VENDOR :
		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;

4873 4874 4875 4876 4877 4878 4879 4880 4881 4882 4883 4884
	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
		setup->path_sel_proto =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
		 IEEE80211_PATH_PROTOCOL_VENDOR :
		 IEEE80211_PATH_PROTOCOL_HWMP;

	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
		setup->path_metric =
		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
		 IEEE80211_PATH_METRIC_VENDOR :
		 IEEE80211_PATH_METRIC_AIRTIME;

4885 4886

	if (tb[NL80211_MESH_SETUP_IE]) {
4887
		struct nlattr *ieattr =
4888
			tb[NL80211_MESH_SETUP_IE];
4889 4890
		if (!is_valid_ie_attr(ieattr))
			return -EINVAL;
4891 4892
		setup->ie = nla_data(ieattr);
		setup->ie_len = nla_len(ieattr);
4893
	}
4894 4895 4896 4897
	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
		return -EINVAL;
	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4898 4899
	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4900 4901
	if (setup->is_secure)
		setup->user_mpm = true;
4902

4903 4904 4905 4906 4907 4908 4909
	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
		if (!setup->user_mpm)
			return -EINVAL;
		setup->auth_id =
			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
	}

4910 4911 4912
	return 0;
}

4913
static int nl80211_update_mesh_config(struct sk_buff *skb,
4914
				      struct genl_info *info)
4915 4916 4917
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
4918
	struct wireless_dev *wdev = dev->ieee80211_ptr;
4919 4920 4921 4922
	struct mesh_config cfg;
	u32 mask;
	int err;

4923 4924 4925
	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

4926
	if (!rdev->ops->update_mesh_config)
4927 4928
		return -EOPNOTSUPP;

4929
	err = nl80211_parse_mesh_config(info, &cfg, &mask);
4930 4931 4932
	if (err)
		return err;

4933 4934 4935 4936 4937
	wdev_lock(wdev);
	if (!wdev->mesh_id_len)
		err = -ENOLINK;

	if (!err)
4938
		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4939 4940 4941 4942

	wdev_unlock(wdev);

	return err;
4943 4944
}

4945 4946
static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
{
4947
	const struct ieee80211_regdomain *regdom;
4948 4949 4950 4951 4952 4953
	struct sk_buff *msg;
	void *hdr = NULL;
	struct nlattr *nl_reg_rules;
	unsigned int i;

	if (!cfg80211_regdomain)
4954
		return -EINVAL;
4955

4956
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4957 4958
	if (!msg)
		return -ENOBUFS;
4959

4960
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4961 4962
			     NL80211_CMD_GET_REG);
	if (!hdr)
4963
		goto put_failure;
4964

4965 4966 4967 4968 4969
	if (reg_last_request_cell_base() &&
	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
			NL80211_USER_REG_HINT_CELL_BASE))
		goto nla_put_failure;

4970 4971 4972 4973 4974 4975 4976 4977
	rcu_read_lock();
	regdom = rcu_dereference(cfg80211_regdomain);

	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
	    (regdom->dfs_region &&
	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
		goto nla_put_failure_rcu;

4978 4979
	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
	if (!nl_reg_rules)
4980
		goto nla_put_failure_rcu;
4981

4982
	for (i = 0; i < regdom->n_reg_rules; i++) {
4983 4984 4985 4986 4987
		struct nlattr *nl_reg_rule;
		const struct ieee80211_reg_rule *reg_rule;
		const struct ieee80211_freq_range *freq_range;
		const struct ieee80211_power_rule *power_rule;

4988
		reg_rule = &regdom->reg_rules[i];
4989 4990 4991 4992 4993
		freq_range = &reg_rule->freq_range;
		power_rule = &reg_rule->power_rule;

		nl_reg_rule = nla_nest_start(msg, i);
		if (!nl_reg_rule)
4994
			goto nla_put_failure_rcu;
4995

4996 4997 4998 4999 5000 5001 5002 5003 5004 5005 5006 5007
		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
				reg_rule->flags) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
				freq_range->start_freq_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
				freq_range->end_freq_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
				freq_range->max_bandwidth_khz) ||
		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
				power_rule->max_antenna_gain) ||
		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
				power_rule->max_eirp))
5008
			goto nla_put_failure_rcu;
5009 5010 5011

		nla_nest_end(msg, nl_reg_rule);
	}
5012
	rcu_read_unlock();
5013 5014 5015 5016

	nla_nest_end(msg, nl_reg_rules);

	genlmsg_end(msg, hdr);
5017
	return genlmsg_reply(msg, info);
5018

5019 5020
nla_put_failure_rcu:
	rcu_read_unlock();
5021 5022
nla_put_failure:
	genlmsg_cancel(msg, hdr);
5023
put_failure:
Y
Yuri Ershov 已提交
5024
	nlmsg_free(msg);
5025
	return -EMSGSIZE;
5026 5027
}

5028 5029 5030 5031 5032 5033 5034
static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
{
	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
	struct nlattr *nl_reg_rule;
	char *alpha2 = NULL;
	int rem_reg_rules = 0, r = 0;
	u32 num_rules = 0, rule_idx = 0, size_of_regd;
5035
	u8 dfs_region = 0;
5036 5037 5038 5039 5040 5041 5042 5043 5044 5045
	struct ieee80211_regdomain *rd = NULL;

	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REG_RULES])
		return -EINVAL;

	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);

5046 5047 5048
	if (info->attrs[NL80211_ATTR_DFS_REGION])
		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);

5049
	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
J
Johannes Berg 已提交
5050
			    rem_reg_rules) {
5051 5052
		num_rules++;
		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5053
			return -EINVAL;
5054 5055 5056
	}

	size_of_regd = sizeof(struct ieee80211_regdomain) +
J
Johannes Berg 已提交
5057
		       num_rules * sizeof(struct ieee80211_reg_rule);
5058 5059

	rd = kzalloc(size_of_regd, GFP_KERNEL);
5060 5061
	if (!rd)
		return -ENOMEM;
5062 5063 5064 5065 5066

	rd->n_reg_rules = num_rules;
	rd->alpha2[0] = alpha2[0];
	rd->alpha2[1] = alpha2[1];

5067 5068 5069 5070 5071 5072 5073
	/*
	 * Disable DFS master mode if the DFS region was
	 * not supported or known on this kernel.
	 */
	if (reg_supported_dfs_region(dfs_region))
		rd->dfs_region = dfs_region;

5074
	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
J
Johannes Berg 已提交
5075
			    rem_reg_rules) {
5076
		nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
J
Johannes Berg 已提交
5077 5078
			  nla_data(nl_reg_rule), nla_len(nl_reg_rule),
			  reg_rule_policy);
5079 5080 5081 5082 5083 5084
		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
		if (r)
			goto bad_reg;

		rule_idx++;

5085 5086
		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
			r = -EINVAL;
5087
			goto bad_reg;
5088
		}
5089 5090 5091
	}

	r = set_regdom(rd);
5092
	/* set_regdom took ownership */
J
Johannes Berg 已提交
5093
	rd = NULL;
5094

5095
 bad_reg:
5096
	kfree(rd);
5097
	return r;
5098 5099
}

5100 5101 5102 5103 5104 5105 5106 5107 5108 5109 5110 5111 5112 5113 5114 5115 5116 5117 5118 5119 5120 5121 5122 5123 5124
static int validate_scan_freqs(struct nlattr *freqs)
{
	struct nlattr *attr1, *attr2;
	int n_channels = 0, tmp1, tmp2;

	nla_for_each_nested(attr1, freqs, tmp1) {
		n_channels++;
		/*
		 * Some hardware has a limited channel list for
		 * scanning, and it is pretty much nonsensical
		 * to scan for a channel twice, so disallow that
		 * and don't require drivers to check that the
		 * channel list they get isn't longer than what
		 * they can scan, as long as they can scan all
		 * the channels they registered at once.
		 */
		nla_for_each_nested(attr2, freqs, tmp2)
			if (attr1 != attr2 &&
			    nla_get_u32(attr1) == nla_get_u32(attr2))
				return 0;
	}

	return n_channels;
}

5125 5126
static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
{
5127
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
J
Johannes Berg 已提交
5128
	struct wireless_dev *wdev = info->user_ptr[1];
5129 5130 5131
	struct cfg80211_scan_request *request;
	struct nlattr *attr;
	struct wiphy *wiphy;
5132
	int err, tmp, n_ssids = 0, n_channels, i;
5133
	size_t ie_len;
5134

5135 5136 5137
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

5138
	wiphy = &rdev->wiphy;
5139

5140 5141
	if (!rdev->ops->scan)
		return -EOPNOTSUPP;
5142

5143 5144 5145 5146
	if (rdev->scan_req) {
		err = -EBUSY;
		goto unlock;
	}
5147 5148

	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5149 5150
		n_channels = validate_scan_freqs(
				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5151 5152 5153 5154
		if (!n_channels) {
			err = -EINVAL;
			goto unlock;
		}
5155
	} else {
5156
		enum ieee80211_band band;
5157 5158
		n_channels = 0;

5159 5160 5161 5162 5163 5164 5165 5166 5167
		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
			if (wiphy->bands[band])
				n_channels += wiphy->bands[band]->n_channels;
	}

	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
			n_ssids++;

5168 5169 5170 5171
	if (n_ssids > wiphy->max_scan_ssids) {
		err = -EINVAL;
		goto unlock;
	}
5172

5173 5174 5175 5176 5177
	if (info->attrs[NL80211_ATTR_IE])
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	else
		ie_len = 0;

5178 5179 5180 5181
	if (ie_len > wiphy->max_scan_ie_len) {
		err = -EINVAL;
		goto unlock;
	}
5182

5183
	request = kzalloc(sizeof(*request)
5184 5185
			+ sizeof(*request->ssids) * n_ssids
			+ sizeof(*request->channels) * n_channels
5186
			+ ie_len, GFP_KERNEL);
5187 5188 5189 5190
	if (!request) {
		err = -ENOMEM;
		goto unlock;
	}
5191 5192

	if (n_ssids)
5193
		request->ssids = (void *)&request->channels[n_channels];
5194
	request->n_ssids = n_ssids;
5195 5196 5197 5198 5199 5200
	if (ie_len) {
		if (request->ssids)
			request->ie = (void *)(request->ssids + n_ssids);
		else
			request->ie = (void *)(request->channels + n_channels);
	}
5201

J
Johannes Berg 已提交
5202
	i = 0;
5203 5204 5205
	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		/* user specified, bail out if channel not found */
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
J
Johannes Berg 已提交
5206 5207 5208 5209 5210
			struct ieee80211_channel *chan;

			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));

			if (!chan) {
5211 5212 5213
				err = -EINVAL;
				goto out_free;
			}
J
Johannes Berg 已提交
5214 5215 5216 5217 5218 5219

			/* ignore disabled channels */
			if (chan->flags & IEEE80211_CHAN_DISABLED)
				continue;

			request->channels[i] = chan;
5220 5221 5222
			i++;
		}
	} else {
5223 5224
		enum ieee80211_band band;

5225 5226 5227 5228 5229 5230
		/* all channels */
		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			int j;
			if (!wiphy->bands[band])
				continue;
			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
J
Johannes Berg 已提交
5231 5232 5233 5234 5235 5236 5237 5238
				struct ieee80211_channel *chan;

				chan = &wiphy->bands[band]->channels[j];

				if (chan->flags & IEEE80211_CHAN_DISABLED)
					continue;

				request->channels[i] = chan;
5239 5240 5241 5242 5243
				i++;
			}
		}
	}

J
Johannes Berg 已提交
5244 5245 5246 5247 5248 5249 5250
	if (!i) {
		err = -EINVAL;
		goto out_free;
	}

	request->n_channels = i;

5251 5252 5253
	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5254
			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5255 5256 5257
				err = -EINVAL;
				goto out_free;
			}
5258
			request->ssids[i].ssid_len = nla_len(attr);
5259 5260 5261 5262 5263
			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
			i++;
		}
	}

5264 5265
	if (info->attrs[NL80211_ATTR_IE]) {
		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5266 5267
		memcpy((void *)request->ie,
		       nla_data(info->attrs[NL80211_ATTR_IE]),
5268 5269 5270
		       request->ie_len);
	}

5271
	for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5272 5273 5274
		if (wiphy->bands[i])
			request->rates[i] =
				(1 << wiphy->bands[i]->n_bitrates) - 1;
5275 5276 5277 5278 5279 5280 5281

	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
				    tmp) {
			enum ieee80211_band band = nla_type(attr);

5282
			if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5283 5284 5285 5286 5287 5288 5289 5290 5291 5292 5293 5294
				err = -EINVAL;
				goto out_free;
			}
			err = ieee80211_get_ratemask(wiphy->bands[band],
						     nla_data(attr),
						     nla_len(attr),
						     &request->rates[band]);
			if (err)
				goto out_free;
		}
	}

5295
	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5296 5297
		request->flags = nla_get_u32(
			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5298 5299 5300 5301
		if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
		     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
		    ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
		     !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5302 5303 5304 5305
			err = -EOPNOTSUPP;
			goto out_free;
		}
	}
5306

5307 5308 5309
	request->no_cck =
		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);

J
Johannes Berg 已提交
5310
	request->wdev = wdev;
5311
	request->wiphy = &rdev->wiphy;
5312
	request->scan_start = jiffies;
5313

5314
	rdev->scan_req = request;
5315
	err = rdev_scan(rdev, request);
5316

5317
	if (!err) {
J
Johannes Berg 已提交
5318 5319 5320
		nl80211_send_scan_start(rdev, wdev);
		if (wdev->netdev)
			dev_hold(wdev->netdev);
5321
	} else {
5322
 out_free:
5323
		rdev->scan_req = NULL;
5324 5325
		kfree(request);
	}
J
Johannes Berg 已提交
5326

5327
 unlock:
5328 5329 5330
	return err;
}

5331 5332 5333 5334 5335 5336 5337 5338
static int nl80211_start_sched_scan(struct sk_buff *skb,
				    struct genl_info *info)
{
	struct cfg80211_sched_scan_request *request;
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct nlattr *attr;
	struct wiphy *wiphy;
5339
	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5340
	u32 interval;
5341 5342
	enum ieee80211_band band;
	size_t ie_len;
5343
	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5344 5345 5346 5347 5348 5349 5350 5351

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
	    !rdev->ops->sched_scan_start)
		return -EOPNOTSUPP;

	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

5352 5353 5354 5355 5356 5357 5358
	if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
		return -EINVAL;

	interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
	if (interval == 0)
		return -EINVAL;

5359 5360 5361 5362 5363 5364 5365 5366 5367 5368 5369 5370 5371 5372 5373 5374 5375 5376 5377 5378
	wiphy = &rdev->wiphy;

	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		n_channels = validate_scan_freqs(
				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
		if (!n_channels)
			return -EINVAL;
	} else {
		n_channels = 0;

		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
			if (wiphy->bands[band])
				n_channels += wiphy->bands[band]->n_channels;
	}

	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
				    tmp)
			n_ssids++;

5379
	if (n_ssids > wiphy->max_sched_scan_ssids)
5380 5381
		return -EINVAL;

5382 5383 5384 5385 5386 5387 5388 5389 5390
	if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
				    tmp)
			n_match_sets++;

	if (n_match_sets > wiphy->max_match_sets)
		return -EINVAL;

5391 5392 5393 5394 5395
	if (info->attrs[NL80211_ATTR_IE])
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	else
		ie_len = 0;

5396
	if (ie_len > wiphy->max_sched_scan_ie_len)
5397 5398
		return -EINVAL;

5399 5400 5401 5402 5403
	if (rdev->sched_scan_req) {
		err = -EINPROGRESS;
		goto out;
	}

5404
	request = kzalloc(sizeof(*request)
5405
			+ sizeof(*request->ssids) * n_ssids
5406
			+ sizeof(*request->match_sets) * n_match_sets
5407
			+ sizeof(*request->channels) * n_channels
5408
			+ ie_len, GFP_KERNEL);
5409 5410 5411 5412
	if (!request) {
		err = -ENOMEM;
		goto out;
	}
5413 5414 5415 5416 5417 5418 5419 5420 5421 5422 5423

	if (n_ssids)
		request->ssids = (void *)&request->channels[n_channels];
	request->n_ssids = n_ssids;
	if (ie_len) {
		if (request->ssids)
			request->ie = (void *)(request->ssids + n_ssids);
		else
			request->ie = (void *)(request->channels + n_channels);
	}

5424 5425 5426 5427 5428 5429 5430 5431 5432 5433 5434 5435
	if (n_match_sets) {
		if (request->ie)
			request->match_sets = (void *)(request->ie + ie_len);
		else if (request->ssids)
			request->match_sets =
				(void *)(request->ssids + n_ssids);
		else
			request->match_sets =
				(void *)(request->channels + n_channels);
	}
	request->n_match_sets = n_match_sets;

5436 5437 5438 5439 5440 5441 5442 5443 5444 5445 5446 5447 5448 5449 5450 5451 5452 5453 5454 5455 5456 5457 5458 5459 5460 5461 5462 5463 5464 5465 5466 5467 5468 5469 5470 5471 5472 5473 5474 5475 5476 5477 5478 5479 5480 5481 5482 5483 5484 5485 5486 5487 5488
	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
		/* user specified, bail out if channel not found */
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
				    tmp) {
			struct ieee80211_channel *chan;

			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));

			if (!chan) {
				err = -EINVAL;
				goto out_free;
			}

			/* ignore disabled channels */
			if (chan->flags & IEEE80211_CHAN_DISABLED)
				continue;

			request->channels[i] = chan;
			i++;
		}
	} else {
		/* all channels */
		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
			int j;
			if (!wiphy->bands[band])
				continue;
			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
				struct ieee80211_channel *chan;

				chan = &wiphy->bands[band]->channels[j];

				if (chan->flags & IEEE80211_CHAN_DISABLED)
					continue;

				request->channels[i] = chan;
				i++;
			}
		}
	}

	if (!i) {
		err = -EINVAL;
		goto out_free;
	}

	request->n_channels = i;

	i = 0;
	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
				    tmp) {
5489
			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5490 5491 5492
				err = -EINVAL;
				goto out_free;
			}
5493
			request->ssids[i].ssid_len = nla_len(attr);
5494 5495 5496 5497 5498 5499
			memcpy(request->ssids[i].ssid, nla_data(attr),
			       nla_len(attr));
			i++;
		}
	}

5500 5501 5502 5503 5504
	i = 0;
	if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
		nla_for_each_nested(attr,
				    info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
				    tmp) {
5505
			struct nlattr *ssid, *rssi;
5506 5507 5508 5509

			nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
				  nla_data(attr), nla_len(attr),
				  nl80211_match_policy);
5510
			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5511 5512 5513 5514 5515 5516 5517 5518 5519 5520
			if (ssid) {
				if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
					err = -EINVAL;
					goto out_free;
				}
				memcpy(request->match_sets[i].ssid.ssid,
				       nla_data(ssid), nla_len(ssid));
				request->match_sets[i].ssid.ssid_len =
					nla_len(ssid);
			}
5521 5522 5523 5524 5525 5526
			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
			if (rssi)
				request->rssi_thold = nla_get_u32(rssi);
			else
				request->rssi_thold =
						   NL80211_SCAN_RSSI_THOLD_OFF;
5527 5528 5529 5530
			i++;
		}
	}

5531 5532 5533 5534 5535 5536 5537
	if (info->attrs[NL80211_ATTR_IE]) {
		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
		memcpy((void *)request->ie,
		       nla_data(info->attrs[NL80211_ATTR_IE]),
		       request->ie_len);
	}

5538
	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5539 5540
		request->flags = nla_get_u32(
			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5541 5542 5543 5544
		if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
		     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
		    ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
		     !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5545 5546 5547 5548
			err = -EOPNOTSUPP;
			goto out_free;
		}
	}
5549

5550 5551
	request->dev = dev;
	request->wiphy = &rdev->wiphy;
5552
	request->interval = interval;
5553
	request->scan_start = jiffies;
5554

5555
	err = rdev_sched_scan_start(rdev, dev, request);
5556 5557 5558 5559 5560 5561 5562 5563 5564 5565 5566 5567 5568 5569 5570 5571 5572 5573 5574 5575 5576 5577
	if (!err) {
		rdev->sched_scan_req = request;
		nl80211_send_sched_scan(rdev, dev,
					NL80211_CMD_START_SCHED_SCAN);
		goto out;
	}

out_free:
	kfree(request);
out:
	return err;
}

static int nl80211_stop_sched_scan(struct sk_buff *skb,
				   struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
	    !rdev->ops->sched_scan_stop)
		return -EOPNOTSUPP;

5578
	return __cfg80211_stop_sched_scan(rdev, false);
5579 5580
}

5581 5582 5583 5584 5585 5586 5587 5588 5589 5590 5591 5592 5593
static int nl80211_start_radar_detection(struct sk_buff *skb,
					 struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_chan_def chandef;
	int err;

	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;

5594 5595 5596
	if (netif_carrier_ok(dev))
		return -EBUSY;

5597 5598 5599 5600 5601 5602 5603 5604 5605 5606 5607 5608 5609 5610 5611 5612 5613 5614 5615 5616
	if (wdev->cac_started)
		return -EBUSY;

	err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
	if (err < 0)
		return err;

	if (err == 0)
		return -EINVAL;

	if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
		return -EINVAL;

	if (!rdev->ops->start_radar_detection)
		return -EOPNOTSUPP;

	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
					   chandef.chan, CHAN_MODE_SHARED,
					   BIT(chandef.width));
	if (err)
5617
		return err;
5618 5619 5620 5621 5622 5623 5624 5625 5626 5627

	err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
	if (!err) {
		wdev->channel = chandef.chan;
		wdev->cac_started = true;
		wdev->cac_start_time = jiffies;
	}
	return err;
}

5628 5629 5630 5631 5632 5633 5634 5635 5636 5637 5638 5639
static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_csa_settings params;
	/* csa_attrs is defined static to avoid waste of stack size - this
	 * function is called under RTNL lock, so this should not be a problem.
	 */
	static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
	u8 radar_detect_width = 0;
	int err;
5640
	bool need_new_beacon = false;
5641 5642 5643 5644 5645

	if (!rdev->ops->channel_switch ||
	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
		return -EOPNOTSUPP;

5646 5647 5648 5649 5650 5651 5652 5653 5654 5655 5656 5657
	switch (dev->ieee80211_ptr->iftype) {
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_P2P_GO:
		need_new_beacon = true;

		/* useless if AP is not running */
		if (!wdev->beacon_interval)
			return -EINVAL;
		break;
	case NL80211_IFTYPE_ADHOC:
		break;
	default:
5658
		return -EOPNOTSUPP;
5659
	}
5660 5661 5662 5663 5664 5665 5666 5667

	memset(&params, 0, sizeof(params));

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
		return -EINVAL;

	/* only important for AP, IBSS and mesh create IEs internally */
5668 5669 5670
	if (need_new_beacon &&
	    (!info->attrs[NL80211_ATTR_CSA_IES] ||
	     !info->attrs[NL80211_ATTR_CSA_C_OFF_BEACON]))
5671 5672 5673 5674
		return -EINVAL;

	params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);

5675 5676 5677
	if (!need_new_beacon)
		goto skip_beacons;

5678 5679 5680 5681 5682 5683 5684 5685 5686 5687 5688 5689 5690 5691 5692 5693 5694 5695 5696 5697 5698 5699 5700 5701 5702 5703 5704 5705 5706 5707 5708 5709 5710 5711 5712 5713 5714 5715 5716
	err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
	if (err)
		return err;

	err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
			       info->attrs[NL80211_ATTR_CSA_IES],
			       nl80211_policy);
	if (err)
		return err;

	err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
	if (err)
		return err;

	if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
		return -EINVAL;

	params.counter_offset_beacon =
		nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
	if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
		return -EINVAL;

	/* sanity check - counters should be the same */
	if (params.beacon_csa.tail[params.counter_offset_beacon] !=
	    params.count)
		return -EINVAL;

	if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
		params.counter_offset_presp =
			nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
		if (params.counter_offset_presp >=
		    params.beacon_csa.probe_resp_len)
			return -EINVAL;

		if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
		    params.count)
			return -EINVAL;
	}

5717
skip_beacons:
5718 5719 5720 5721 5722 5723 5724
	err = nl80211_parse_chandef(rdev, info, &params.chandef);
	if (err)
		return err;

	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
		return -EINVAL;

5725 5726 5727 5728 5729 5730 5731 5732 5733 5734 5735
	/* DFS channels are only supported for AP/P2P GO ... for now. */
	if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
	    dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
		err = cfg80211_chandef_dfs_required(wdev->wiphy,
						    &params.chandef);
		if (err < 0) {
			return err;
		} else if (err) {
			radar_detect_width = BIT(params.chandef.width);
			params.radar_required = true;
		}
5736 5737 5738 5739 5740 5741 5742 5743 5744 5745 5746 5747 5748 5749 5750
	}

	err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
					   params.chandef.chan,
					   CHAN_MODE_SHARED,
					   radar_detect_width);
	if (err)
		return err;

	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
		params.block_tx = true;

	return rdev_channel_switch(rdev, dev, &params);
}

5751 5752
static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
			    u32 seq, int flags,
5753
			    struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
5754 5755
			    struct wireless_dev *wdev,
			    struct cfg80211_internal_bss *intbss)
5756
{
J
Johannes Berg 已提交
5757
	struct cfg80211_bss *res = &intbss->pub;
5758
	const struct cfg80211_bss_ies *ies;
5759 5760
	void *hdr;
	struct nlattr *bss;
J
Johannes Berg 已提交
5761
	bool tsf = false;
J
Johannes Berg 已提交
5762 5763

	ASSERT_WDEV_LOCK(wdev);
5764

5765
	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5766 5767 5768 5769
			     NL80211_CMD_NEW_SCAN_RESULTS);
	if (!hdr)
		return -1;

5770 5771
	genl_dump_check_consistent(cb, hdr, &nl80211_fam);

5772 5773 5774
	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
		goto nla_put_failure;
	if (wdev->netdev &&
5775 5776
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
		goto nla_put_failure;
5777 5778
	if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto nla_put_failure;
5779 5780 5781 5782

	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
	if (!bss)
		goto nla_put_failure;
5783
	if ((!is_zero_ether_addr(res->bssid) &&
5784
	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5785
		goto nla_put_failure;
5786 5787 5788

	rcu_read_lock();
	ies = rcu_dereference(res->ies);
J
Johannes Berg 已提交
5789 5790 5791 5792 5793 5794 5795
	if (ies) {
		if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
			goto fail_unlock_rcu;
		tsf = true;
		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
					ies->len, ies->data))
			goto fail_unlock_rcu;
5796 5797
	}
	ies = rcu_dereference(res->beacon_ies);
J
Johannes Berg 已提交
5798 5799 5800 5801 5802 5803
	if (ies) {
		if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
			goto fail_unlock_rcu;
		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
					ies->len, ies->data))
			goto fail_unlock_rcu;
5804 5805 5806
	}
	rcu_read_unlock();

5807 5808 5809 5810 5811
	if (res->beacon_interval &&
	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
		goto nla_put_failure;
	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5812
	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5813 5814 5815
	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
			jiffies_to_msecs(jiffies - intbss->ts)))
		goto nla_put_failure;
5816

J
Johannes Berg 已提交
5817
	switch (rdev->wiphy.signal_type) {
5818
	case CFG80211_SIGNAL_TYPE_MBM:
5819 5820
		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
			goto nla_put_failure;
5821 5822
		break;
	case CFG80211_SIGNAL_TYPE_UNSPEC:
5823 5824
		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
			goto nla_put_failure;
5825 5826 5827 5828 5829
		break;
	default:
		break;
	}

J
Johannes Berg 已提交
5830
	switch (wdev->iftype) {
5831
	case NL80211_IFTYPE_P2P_CLIENT:
J
Johannes Berg 已提交
5832
	case NL80211_IFTYPE_STATION:
5833 5834 5835 5836
		if (intbss == wdev->current_bss &&
		    nla_put_u32(msg, NL80211_BSS_STATUS,
				NL80211_BSS_STATUS_ASSOCIATED))
			goto nla_put_failure;
J
Johannes Berg 已提交
5837 5838
		break;
	case NL80211_IFTYPE_ADHOC:
5839 5840 5841 5842
		if (intbss == wdev->current_bss &&
		    nla_put_u32(msg, NL80211_BSS_STATUS,
				NL80211_BSS_STATUS_IBSS_JOINED))
			goto nla_put_failure;
J
Johannes Berg 已提交
5843 5844 5845 5846 5847
		break;
	default:
		break;
	}

5848 5849 5850 5851
	nla_nest_end(msg, bss);

	return genlmsg_end(msg, hdr);

J
Johannes Berg 已提交
5852 5853
 fail_unlock_rcu:
	rcu_read_unlock();
5854 5855 5856 5857 5858
 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

5859
static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5860
{
J
Johannes Berg 已提交
5861
	struct cfg80211_registered_device *rdev;
5862
	struct cfg80211_internal_bss *scan;
J
Johannes Berg 已提交
5863
	struct wireless_dev *wdev;
5864
	int start = cb->args[2], idx = 0;
5865 5866
	int err;

5867
	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5868 5869
	if (err)
		return err;
5870

J
Johannes Berg 已提交
5871 5872 5873 5874
	wdev_lock(wdev);
	spin_lock_bh(&rdev->bss_lock);
	cfg80211_bss_expire(rdev);

5875 5876
	cb->seq = rdev->bss_generation;

J
Johannes Berg 已提交
5877
	list_for_each_entry(scan, &rdev->bss_list, list) {
5878 5879
		if (++idx <= start)
			continue;
5880
		if (nl80211_send_bss(skb, cb,
5881
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
J
Johannes Berg 已提交
5882
				rdev, wdev, scan) < 0) {
5883
			idx--;
5884
			break;
5885 5886 5887
		}
	}

J
Johannes Berg 已提交
5888 5889
	spin_unlock_bh(&rdev->bss_lock);
	wdev_unlock(wdev);
5890

5891 5892
	cb->args[2] = idx;
	nl80211_finish_wdev_dump(rdev);
5893

5894
	return skb->len;
5895 5896
}

5897
static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5898 5899 5900 5901 5902 5903
				int flags, struct net_device *dev,
				struct survey_info *survey)
{
	void *hdr;
	struct nlattr *infoattr;

5904
	hdr = nl80211hdr_put(msg, portid, seq, flags,
5905 5906 5907 5908
			     NL80211_CMD_NEW_SURVEY_RESULTS);
	if (!hdr)
		return -ENOMEM;

5909 5910
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
		goto nla_put_failure;
5911 5912 5913 5914 5915

	infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
	if (!infoattr)
		goto nla_put_failure;

5916 5917 5918 5919 5920 5921 5922 5923 5924 5925 5926 5927 5928 5929 5930 5931 5932 5933 5934 5935 5936 5937 5938 5939 5940 5941 5942 5943 5944 5945
	if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
			survey->channel->center_freq))
		goto nla_put_failure;

	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_IN_USE) &&
	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
			survey->channel_time))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
			survey->channel_time_busy))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
			survey->channel_time_ext_busy))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
			survey->channel_time_rx))
		goto nla_put_failure;
	if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
	    nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
			survey->channel_time_tx))
		goto nla_put_failure;
5946 5947 5948 5949 5950 5951 5952 5953 5954 5955 5956 5957 5958 5959 5960

	nla_nest_end(msg, infoattr);

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

static int nl80211_dump_survey(struct sk_buff *skb,
			struct netlink_callback *cb)
{
	struct survey_info survey;
	struct cfg80211_registered_device *dev;
5961 5962
	struct wireless_dev *wdev;
	int survey_idx = cb->args[2];
5963 5964
	int res;

5965
	res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5966 5967
	if (res)
		return res;
5968

5969 5970 5971 5972 5973
	if (!wdev->netdev) {
		res = -EINVAL;
		goto out_err;
	}

5974 5975 5976 5977 5978 5979
	if (!dev->ops->dump_survey) {
		res = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
5980 5981
		struct ieee80211_channel *chan;

5982
		res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5983 5984 5985 5986 5987
		if (res == -ENOENT)
			break;
		if (res)
			goto out_err;

5988 5989 5990 5991 5992 5993 5994 5995 5996 5997 5998 5999 6000
		/* Survey without a channel doesn't make sense */
		if (!survey.channel) {
			res = -EINVAL;
			goto out;
		}

		chan = ieee80211_get_channel(&dev->wiphy,
					     survey.channel->center_freq);
		if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
			survey_idx++;
			continue;
		}

6001
		if (nl80211_send_survey(skb,
6002
				NETLINK_CB(cb->skb).portid,
6003
				cb->nlh->nlmsg_seq, NLM_F_MULTI,
6004
				wdev->netdev, &survey) < 0)
6005 6006 6007 6008 6009
			goto out;
		survey_idx++;
	}

 out:
6010
	cb->args[2] = survey_idx;
6011 6012
	res = skb->len;
 out_err:
6013
	nl80211_finish_wdev_dump(dev);
6014 6015 6016
	return res;
}

S
Samuel Ortiz 已提交
6017 6018 6019 6020 6021 6022
static bool nl80211_valid_wpa_versions(u32 wpa_versions)
{
	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
				  NL80211_WPA_VERSION_2));
}

6023 6024
static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
{
6025 6026
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6027
	struct ieee80211_channel *chan;
6028 6029
	const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
	int err, ssid_len, ie_len = 0, sae_data_len = 0;
J
Johannes Berg 已提交
6030
	enum nl80211_auth_type auth_type;
J
Johannes Berg 已提交
6031
	struct key_parse key;
6032
	bool local_state_change;
6033

6034 6035 6036 6037 6038 6039
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

6040 6041 6042
	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
		return -EINVAL;

J
Johannes Berg 已提交
6043 6044 6045 6046 6047 6048
	if (!info->attrs[NL80211_ATTR_SSID])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
		return -EINVAL;

J
Johannes Berg 已提交
6049 6050 6051 6052 6053
	err = nl80211_parse_key(info, &key);
	if (err)
		return err;

	if (key.idx >= 0) {
6054 6055
		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
			return -EINVAL;
J
Johannes Berg 已提交
6056 6057 6058 6059 6060 6061 6062 6063 6064 6065 6066 6067 6068 6069
		if (!key.p.key || !key.p.key_len)
			return -EINVAL;
		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
		     key.p.key_len != WLAN_KEY_LEN_WEP104))
			return -EINVAL;
		if (key.idx > 4)
			return -EINVAL;
	} else {
		key.p.key_len = 0;
		key.p.key = NULL;
	}

6070 6071 6072 6073 6074 6075 6076 6077 6078
	if (key.idx >= 0) {
		int i;
		bool ok = false;
		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
				ok = true;
				break;
			}
		}
6079 6080
		if (!ok)
			return -EINVAL;
6081 6082
	}

6083 6084
	if (!rdev->ops->auth)
		return -EOPNOTSUPP;
6085

6086
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6087 6088
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6089

J
Johannes Berg 已提交
6090
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6091
	chan = ieee80211_get_channel(&rdev->wiphy,
J
Johannes Berg 已提交
6092
		nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6093 6094
	if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
		return -EINVAL;
6095

J
Johannes Berg 已提交
6096 6097
	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6098 6099

	if (info->attrs[NL80211_ATTR_IE]) {
J
Johannes Berg 已提交
6100 6101
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6102 6103
	}

J
Johannes Berg 已提交
6104
	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6105
	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6106
		return -EINVAL;
6107

6108 6109 6110 6111 6112 6113 6114 6115 6116 6117 6118 6119 6120 6121
	if (auth_type == NL80211_AUTHTYPE_SAE &&
	    !info->attrs[NL80211_ATTR_SAE_DATA])
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_SAE_DATA]) {
		if (auth_type != NL80211_AUTHTYPE_SAE)
			return -EINVAL;
		sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
		sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
		/* need to include at least Auth Transaction and Status Code */
		if (sae_data_len < 4)
			return -EINVAL;
	}

6122 6123
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6124 6125 6126 6127 6128 6129 6130
	/*
	 * Since we no longer track auth state, ignore
	 * requests to only change local state.
	 */
	if (local_state_change)
		return 0;

6131 6132 6133 6134 6135 6136 6137
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
				 ssid, ssid_len, ie, ie_len,
				 key.p.key, key.p.key_len, key.idx,
				 sae_data, sae_data_len);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6138 6139
}

6140 6141
static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
				   struct genl_info *info,
6142 6143
				   struct cfg80211_crypto_settings *settings,
				   int cipher_limit)
S
Samuel Ortiz 已提交
6144
{
6145 6146
	memset(settings, 0, sizeof(*settings));

S
Samuel Ortiz 已提交
6147 6148
	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];

6149 6150 6151 6152 6153 6154 6155 6156 6157 6158 6159 6160 6161
	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
		u16 proto;
		proto = nla_get_u16(
			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
		settings->control_port_ethertype = cpu_to_be16(proto);
		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
		    proto != ETH_P_PAE)
			return -EINVAL;
		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
			settings->control_port_no_encrypt = true;
	} else
		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);

S
Samuel Ortiz 已提交
6162 6163 6164 6165 6166 6167 6168 6169 6170 6171 6172
	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
		void *data;
		int len, i;

		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
		settings->n_ciphers_pairwise = len / sizeof(u32);

		if (len % sizeof(u32))
			return -EINVAL;

6173
		if (settings->n_ciphers_pairwise > cipher_limit)
S
Samuel Ortiz 已提交
6174 6175 6176 6177 6178
			return -EINVAL;

		memcpy(settings->ciphers_pairwise, data, len);

		for (i = 0; i < settings->n_ciphers_pairwise; i++)
6179 6180
			if (!cfg80211_supported_cipher_suite(
					&rdev->wiphy,
S
Samuel Ortiz 已提交
6181 6182 6183 6184 6185 6186 6187
					settings->ciphers_pairwise[i]))
				return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
		settings->cipher_group =
			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6188 6189
		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
						     settings->cipher_group))
S
Samuel Ortiz 已提交
6190 6191 6192 6193 6194 6195 6196 6197 6198 6199 6200 6201
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
		settings->wpa_versions =
			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
		void *data;
6202
		int len;
S
Samuel Ortiz 已提交
6203 6204 6205 6206 6207 6208 6209 6210

		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
		settings->n_akm_suites = len / sizeof(u32);

		if (len % sizeof(u32))
			return -EINVAL;

6211 6212 6213
		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
			return -EINVAL;

S
Samuel Ortiz 已提交
6214 6215 6216 6217 6218 6219
		memcpy(settings->akm_suites, data, len);
	}

	return 0;
}

6220 6221
static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
{
6222 6223
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
6224
	struct ieee80211_channel *chan;
6225 6226 6227
	struct cfg80211_assoc_request req = {};
	const u8 *bssid, *ssid;
	int err, ssid_len = 0;
6228

6229 6230 6231 6232
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC] ||
J
Johannes Berg 已提交
6233 6234
	    !info->attrs[NL80211_ATTR_SSID] ||
	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6235 6236
		return -EINVAL;

6237 6238
	if (!rdev->ops->assoc)
		return -EOPNOTSUPP;
6239

6240
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6241 6242
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6243

J
Johannes Berg 已提交
6244
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6245

J
Johannes Berg 已提交
6246 6247
	chan = ieee80211_get_channel(&rdev->wiphy,
		nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6248 6249
	if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
		return -EINVAL;
6250

J
Johannes Berg 已提交
6251 6252
	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6253 6254

	if (info->attrs[NL80211_ATTR_IE]) {
6255 6256
		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6257 6258
	}

6259
	if (info->attrs[NL80211_ATTR_USE_MFP]) {
6260
		enum nl80211_mfp mfp =
6261
			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6262
		if (mfp == NL80211_MFP_REQUIRED)
6263
			req.use_mfp = true;
6264 6265
		else if (mfp != NL80211_MFP_NO)
			return -EINVAL;
6266 6267
	}

6268
	if (info->attrs[NL80211_ATTR_PREV_BSSID])
6269
		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6270

6271
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6272
		req.flags |= ASSOC_REQ_DISABLE_HT;
6273 6274

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6275 6276 6277
		memcpy(&req.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(req.ht_capa_mask));
6278 6279

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6280
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6281
			return -EINVAL;
6282 6283 6284
		memcpy(&req.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(req.ht_capa));
6285 6286
	}

6287
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6288
		req.flags |= ASSOC_REQ_DISABLE_VHT;
6289 6290

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6291 6292 6293
		memcpy(&req.vht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
		       sizeof(req.vht_capa_mask));
6294 6295

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6296
		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6297
			return -EINVAL;
6298 6299 6300
		memcpy(&req.vht_capa,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
		       sizeof(req.vht_capa));
6301 6302
	}

6303
	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6304 6305
	if (!err) {
		wdev_lock(dev->ieee80211_ptr);
6306 6307
		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
					  ssid, ssid_len, &req);
6308 6309
		wdev_unlock(dev->ieee80211_ptr);
	}
6310 6311 6312 6313 6314 6315

	return err;
}

static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
{
6316 6317
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6318
	const u8 *ie = NULL, *bssid;
6319
	int ie_len = 0, err;
J
Johannes Berg 已提交
6320
	u16 reason_code;
6321
	bool local_state_change;
6322

6323 6324 6325 6326 6327 6328 6329 6330 6331
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		return -EINVAL;

6332 6333
	if (!rdev->ops->deauth)
		return -EOPNOTSUPP;
6334

6335
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6336 6337
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6338

J
Johannes Berg 已提交
6339
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6340

J
Johannes Berg 已提交
6341 6342
	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
	if (reason_code == 0) {
6343
		/* Reason Code 0 is reserved */
6344
		return -EINVAL;
6345
	}
6346 6347

	if (info->attrs[NL80211_ATTR_IE]) {
J
Johannes Berg 已提交
6348 6349
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6350 6351
	}

6352 6353
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6354 6355 6356 6357 6358
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
				   local_state_change);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6359 6360 6361 6362
}

static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
{
6363 6364
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6365
	const u8 *ie = NULL, *bssid;
6366
	int ie_len = 0, err;
J
Johannes Berg 已提交
6367
	u16 reason_code;
6368
	bool local_state_change;
6369

6370 6371 6372 6373 6374 6375 6376 6377 6378
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		return -EINVAL;

6379 6380
	if (!rdev->ops->disassoc)
		return -EOPNOTSUPP;
6381

6382
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6383 6384
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
6385

J
Johannes Berg 已提交
6386
	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6387

J
Johannes Berg 已提交
6388 6389
	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
	if (reason_code == 0) {
6390
		/* Reason Code 0 is reserved */
6391
		return -EINVAL;
6392
	}
6393 6394

	if (info->attrs[NL80211_ATTR_IE]) {
J
Johannes Berg 已提交
6395 6396
		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6397 6398
	}

6399 6400
	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];

6401 6402 6403 6404 6405
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
				     local_state_change);
	wdev_unlock(dev->ieee80211_ptr);
	return err;
6406 6407
}

6408 6409 6410 6411 6412 6413 6414 6415 6416 6417 6418 6419 6420 6421 6422 6423 6424 6425 6426 6427 6428 6429 6430 6431 6432 6433 6434 6435
static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
			 int mcast_rate[IEEE80211_NUM_BANDS],
			 int rateval)
{
	struct wiphy *wiphy = &rdev->wiphy;
	bool found = false;
	int band, i;

	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
		struct ieee80211_supported_band *sband;

		sband = wiphy->bands[band];
		if (!sband)
			continue;

		for (i = 0; i < sband->n_bitrates; i++) {
			if (sband->bitrates[i].bitrate == rateval) {
				mcast_rate[band] = i + 1;
				found = true;
				break;
			}
		}
	}

	return found;
}

J
Johannes Berg 已提交
6436 6437
static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
{
6438 6439
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6440 6441
	struct cfg80211_ibss_params ibss;
	struct wiphy *wiphy;
J
Johannes Berg 已提交
6442
	struct cfg80211_cached_keys *connkeys = NULL;
J
Johannes Berg 已提交
6443 6444
	int err;

6445 6446
	memset(&ibss, 0, sizeof(ibss));

J
Johannes Berg 已提交
6447 6448 6449
	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

6450
	if (!info->attrs[NL80211_ATTR_SSID] ||
J
Johannes Berg 已提交
6451 6452 6453
	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
		return -EINVAL;

6454 6455 6456 6457 6458 6459 6460 6461 6462
	ibss.beacon_interval = 100;

	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
		ibss.beacon_interval =
			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
		if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
			return -EINVAL;
	}

6463 6464
	if (!rdev->ops->join_ibss)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6465

6466 6467
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6468

6469
	wiphy = &rdev->wiphy;
J
Johannes Berg 已提交
6470

J
Johannes Berg 已提交
6471
	if (info->attrs[NL80211_ATTR_MAC]) {
J
Johannes Berg 已提交
6472
		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
J
Johannes Berg 已提交
6473 6474 6475 6476

		if (!is_valid_ether_addr(ibss.bssid))
			return -EINVAL;
	}
J
Johannes Berg 已提交
6477 6478 6479 6480 6481 6482 6483 6484
	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);

	if (info->attrs[NL80211_ATTR_IE]) {
		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	}

6485 6486 6487
	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
	if (err)
		return err;
J
Johannes Berg 已提交
6488

6489
	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6490 6491
		return -EINVAL;

6492
	switch (ibss.chandef.width) {
6493 6494
	case NL80211_CHAN_WIDTH_5:
	case NL80211_CHAN_WIDTH_10:
6495 6496 6497 6498 6499 6500 6501
	case NL80211_CHAN_WIDTH_20_NOHT:
		break;
	case NL80211_CHAN_WIDTH_20:
	case NL80211_CHAN_WIDTH_40:
		if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
			break;
	default:
6502
		return -EINVAL;
6503
	}
6504

J
Johannes Berg 已提交
6505
	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
J
Johannes Berg 已提交
6506 6507
	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];

6508 6509 6510 6511 6512 6513
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		u8 *rates =
			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		int n_rates =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		struct ieee80211_supported_band *sband =
6514
			wiphy->bands[ibss.chandef.chan->band];
6515

6516 6517 6518 6519
		err = ieee80211_get_ratemask(sband, rates, n_rates,
					     &ibss.basic_rates);
		if (err)
			return err;
6520
	}
6521

6522 6523 6524 6525 6526 6527 6528 6529 6530 6531 6532 6533 6534
	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
		memcpy(&ibss.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(ibss.ht_capa_mask));

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
			return -EINVAL;
		memcpy(&ibss.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(ibss.ht_capa));
	}

6535 6536 6537 6538
	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
		return -EINVAL;
6539

6540
	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6541 6542
		bool no_ht = false;

6543
		connkeys = nl80211_parse_connkeys(rdev,
6544 6545
					  info->attrs[NL80211_ATTR_KEYS],
					  &no_ht);
6546 6547
		if (IS_ERR(connkeys))
			return PTR_ERR(connkeys);
6548

6549 6550
		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
		    no_ht) {
6551 6552 6553
			kfree(connkeys);
			return -EINVAL;
		}
6554
	}
J
Johannes Berg 已提交
6555

6556 6557 6558
	ibss.control_port =
		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);

6559
	err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
J
Johannes Berg 已提交
6560 6561
	if (err)
		kfree(connkeys);
J
Johannes Berg 已提交
6562 6563 6564 6565 6566
	return err;
}

static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
{
6567 6568
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
J
Johannes Berg 已提交
6569

6570 6571
	if (!rdev->ops->leave_ibss)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6572

6573 6574
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
		return -EOPNOTSUPP;
J
Johannes Berg 已提交
6575

6576
	return cfg80211_leave_ibss(rdev, dev, false);
J
Johannes Berg 已提交
6577 6578
}

6579 6580 6581 6582 6583 6584 6585 6586 6587 6588 6589 6590 6591 6592 6593 6594 6595 6596 6597 6598 6599 6600 6601 6602 6603 6604 6605 6606 6607 6608
static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	int mcast_rate[IEEE80211_NUM_BANDS];
	u32 nla_rate;
	int err;

	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
		return -EOPNOTSUPP;

	if (!rdev->ops->set_mcast_rate)
		return -EOPNOTSUPP;

	memset(mcast_rate, 0, sizeof(mcast_rate));

	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
		return -EINVAL;

	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
		return -EINVAL;

	err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);

	return err;
}


6609 6610 6611 6612 6613 6614 6615
#ifdef CONFIG_NL80211_TESTMODE
static struct genl_multicast_group nl80211_testmode_mcgrp = {
	.name = "testmode",
};

static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
{
6616
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6617 6618
	struct wireless_dev *wdev =
		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6619 6620
	int err;

6621 6622 6623 6624 6625 6626 6627 6628 6629 6630 6631 6632
	if (!rdev->ops->testmode_cmd)
		return -EOPNOTSUPP;

	if (IS_ERR(wdev)) {
		err = PTR_ERR(wdev);
		if (err != -EINVAL)
			return err;
		wdev = NULL;
	} else if (wdev->wiphy != &rdev->wiphy) {
		return -EINVAL;
	}

6633 6634 6635
	if (!info->attrs[NL80211_ATTR_TESTDATA])
		return -EINVAL;

6636 6637
	rdev->testmode_info = info;
	err = rdev_testmode_cmd(rdev, wdev,
6638 6639
				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6640
	rdev->testmode_info = NULL;
6641 6642 6643 6644

	return err;
}

W
Wey-Yi Guy 已提交
6645 6646 6647
static int nl80211_testmode_dump(struct sk_buff *skb,
				 struct netlink_callback *cb)
{
6648
	struct cfg80211_registered_device *rdev;
W
Wey-Yi Guy 已提交
6649 6650 6651 6652 6653
	int err;
	long phy_idx;
	void *data = NULL;
	int data_len = 0;

6654 6655
	rtnl_lock();

W
Wey-Yi Guy 已提交
6656 6657 6658 6659 6660 6661 6662 6663 6664 6665 6666
	if (cb->args[0]) {
		/*
		 * 0 is a valid index, but not valid for args[0],
		 * so we need to offset by 1.
		 */
		phy_idx = cb->args[0] - 1;
	} else {
		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
				  nl80211_policy);
		if (err)
6667
			goto out_err;
6668

6669 6670 6671
		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
						  nl80211_fam.attrbuf);
		if (IS_ERR(rdev)) {
6672 6673
			err = PTR_ERR(rdev);
			goto out_err;
6674
		}
6675 6676 6677
		phy_idx = rdev->wiphy_idx;
		rdev = NULL;

W
Wey-Yi Guy 已提交
6678 6679 6680 6681 6682 6683 6684 6685 6686 6687
		if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
			cb->args[1] =
				(long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
	}

	if (cb->args[1]) {
		data = nla_data((void *)cb->args[1]);
		data_len = nla_len((void *)cb->args[1]);
	}

6688 6689
	rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
	if (!rdev) {
6690 6691
		err = -ENOENT;
		goto out_err;
W
Wey-Yi Guy 已提交
6692 6693
	}

6694
	if (!rdev->ops->testmode_dump) {
W
Wey-Yi Guy 已提交
6695 6696 6697 6698 6699
		err = -EOPNOTSUPP;
		goto out_err;
	}

	while (1) {
6700
		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
W
Wey-Yi Guy 已提交
6701 6702 6703 6704
					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
					   NL80211_CMD_TESTMODE);
		struct nlattr *tmdata;

6705 6706 6707
		if (!hdr)
			break;

6708
		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
W
Wey-Yi Guy 已提交
6709 6710 6711 6712 6713 6714 6715 6716 6717
			genlmsg_cancel(skb, hdr);
			break;
		}

		tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
		if (!tmdata) {
			genlmsg_cancel(skb, hdr);
			break;
		}
6718
		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
W
Wey-Yi Guy 已提交
6719 6720 6721 6722 6723 6724 6725 6726 6727 6728 6729 6730 6731 6732 6733 6734 6735
		nla_nest_end(skb, tmdata);

		if (err == -ENOBUFS || err == -ENOENT) {
			genlmsg_cancel(skb, hdr);
			break;
		} else if (err) {
			genlmsg_cancel(skb, hdr);
			goto out_err;
		}

		genlmsg_end(skb, hdr);
	}

	err = skb->len;
	/* see above */
	cb->args[0] = phy_idx + 1;
 out_err:
6736
	rtnl_unlock();
W
Wey-Yi Guy 已提交
6737 6738 6739
	return err;
}

6740 6741
static struct sk_buff *
__cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6742
			      int approxlen, u32 portid, u32 seq, gfp_t gfp)
6743 6744 6745 6746 6747 6748 6749 6750 6751
{
	struct sk_buff *skb;
	void *hdr;
	struct nlattr *data;

	skb = nlmsg_new(approxlen + 100, gfp);
	if (!skb)
		return NULL;

6752
	hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6753 6754 6755 6756 6757
	if (!hdr) {
		kfree_skb(skb);
		return NULL;
	}

6758 6759
	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
		goto nla_put_failure;
6760 6761 6762 6763 6764 6765 6766 6767 6768 6769 6770 6771 6772 6773 6774 6775 6776 6777 6778 6779 6780 6781
	data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);

	((void **)skb->cb)[0] = rdev;
	((void **)skb->cb)[1] = hdr;
	((void **)skb->cb)[2] = data;

	return skb;

 nla_put_failure:
	kfree_skb(skb);
	return NULL;
}

struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
						  int approxlen)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	if (WARN_ON(!rdev->testmode_info))
		return NULL;

	return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6782
				rdev->testmode_info->snd_portid,
6783 6784 6785 6786 6787 6788 6789 6790 6791 6792 6793 6794 6795 6796 6797 6798 6799 6800 6801 6802 6803 6804 6805 6806 6807 6808 6809 6810 6811 6812 6813 6814 6815
				rdev->testmode_info->snd_seq,
				GFP_KERNEL);
}
EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);

int cfg80211_testmode_reply(struct sk_buff *skb)
{
	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
	void *hdr = ((void **)skb->cb)[1];
	struct nlattr *data = ((void **)skb->cb)[2];

	if (WARN_ON(!rdev->testmode_info)) {
		kfree_skb(skb);
		return -EINVAL;
	}

	nla_nest_end(skb, data);
	genlmsg_end(skb, hdr);
	return genlmsg_reply(skb, rdev->testmode_info);
}
EXPORT_SYMBOL(cfg80211_testmode_reply);

struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
						  int approxlen, gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
}
EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);

void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
{
6816
	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6817 6818 6819 6820 6821
	void *hdr = ((void **)skb->cb)[1];
	struct nlattr *data = ((void **)skb->cb)[2];

	nla_nest_end(skb, data);
	genlmsg_end(skb, hdr);
6822 6823
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
				nl80211_testmode_mcgrp.id, gfp);
6824 6825 6826 6827
}
EXPORT_SYMBOL(cfg80211_testmode_event);
#endif

S
Samuel Ortiz 已提交
6828 6829
static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
{
6830 6831
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
6832 6833
	struct cfg80211_connect_params connect;
	struct wiphy *wiphy;
J
Johannes Berg 已提交
6834
	struct cfg80211_cached_keys *connkeys = NULL;
S
Samuel Ortiz 已提交
6835 6836 6837 6838 6839 6840 6841 6842 6843 6844 6845 6846 6847 6848
	int err;

	memset(&connect, 0, sizeof(connect));

	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_SSID] ||
	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
		return -EINVAL;

	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
		connect.auth_type =
			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6849 6850
		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
					     NL80211_CMD_CONNECT))
S
Samuel Ortiz 已提交
6851 6852 6853 6854 6855 6856
			return -EINVAL;
	} else
		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;

	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];

6857
	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6858
				      NL80211_MAX_NR_CIPHER_SUITES);
S
Samuel Ortiz 已提交
6859 6860 6861
	if (err)
		return err;

6862
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6863 6864
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
6865

6866
	wiphy = &rdev->wiphy;
S
Samuel Ortiz 已提交
6867

6868 6869 6870 6871 6872 6873 6874
	connect.bg_scan_period = -1;
	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
		connect.bg_scan_period =
			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
	}

S
Samuel Ortiz 已提交
6875 6876 6877 6878 6879 6880 6881 6882 6883 6884
	if (info->attrs[NL80211_ATTR_MAC])
		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);

	if (info->attrs[NL80211_ATTR_IE]) {
		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
	}

6885 6886 6887 6888 6889 6890 6891 6892 6893
	if (info->attrs[NL80211_ATTR_USE_MFP]) {
		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
		if (connect.mfp != NL80211_MFP_REQUIRED &&
		    connect.mfp != NL80211_MFP_NO)
			return -EINVAL;
	} else {
		connect.mfp = NL80211_MFP_NO;
	}

S
Samuel Ortiz 已提交
6894 6895 6896 6897 6898
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
		connect.channel =
			ieee80211_get_channel(wiphy,
			    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
		if (!connect.channel ||
6899 6900
		    connect.channel->flags & IEEE80211_CHAN_DISABLED)
			return -EINVAL;
S
Samuel Ortiz 已提交
6901 6902
	}

J
Johannes Berg 已提交
6903 6904
	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
		connkeys = nl80211_parse_connkeys(rdev,
6905
					  info->attrs[NL80211_ATTR_KEYS], NULL);
6906 6907
		if (IS_ERR(connkeys))
			return PTR_ERR(connkeys);
J
Johannes Berg 已提交
6908 6909
	}

6910 6911 6912 6913 6914 6915 6916 6917 6918
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
		connect.flags |= ASSOC_REQ_DISABLE_HT;

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
		memcpy(&connect.ht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
		       sizeof(connect.ht_capa_mask));

	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6919 6920
		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
			kfree(connkeys);
6921
			return -EINVAL;
6922
		}
6923 6924 6925 6926 6927
		memcpy(&connect.ht_capa,
		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
		       sizeof(connect.ht_capa));
	}

6928 6929 6930 6931 6932 6933 6934 6935 6936 6937 6938 6939 6940 6941 6942 6943 6944 6945
	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
		connect.flags |= ASSOC_REQ_DISABLE_VHT;

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
		memcpy(&connect.vht_capa_mask,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
		       sizeof(connect.vht_capa_mask));

	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
			kfree(connkeys);
			return -EINVAL;
		}
		memcpy(&connect.vht_capa,
		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
		       sizeof(connect.vht_capa));
	}

6946 6947 6948
	wdev_lock(dev->ieee80211_ptr);
	err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
	wdev_unlock(dev->ieee80211_ptr);
J
Johannes Berg 已提交
6949 6950
	if (err)
		kfree(connkeys);
S
Samuel Ortiz 已提交
6951 6952 6953 6954 6955
	return err;
}

static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
{
6956 6957
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
6958
	u16 reason;
6959
	int ret;
S
Samuel Ortiz 已提交
6960 6961 6962 6963 6964 6965 6966 6967 6968

	if (!info->attrs[NL80211_ATTR_REASON_CODE])
		reason = WLAN_REASON_DEAUTH_LEAVING;
	else
		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);

	if (reason == 0)
		return -EINVAL;

6969
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6970 6971
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
6972

6973 6974 6975 6976
	wdev_lock(dev->ieee80211_ptr);
	ret = cfg80211_disconnect(rdev, dev, reason, true);
	wdev_unlock(dev->ieee80211_ptr);
	return ret;
S
Samuel Ortiz 已提交
6977 6978
}

6979 6980
static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
{
6981
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6982 6983 6984 6985 6986 6987 6988 6989 6990 6991
	struct net *net;
	int err;
	u32 pid;

	if (!info->attrs[NL80211_ATTR_PID])
		return -EINVAL;

	pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);

	net = get_net_ns_by_pid(pid);
6992 6993
	if (IS_ERR(net))
		return PTR_ERR(net);
6994 6995 6996 6997

	err = 0;

	/* check if anything to do */
6998 6999
	if (!net_eq(wiphy_net(&rdev->wiphy), net))
		err = cfg80211_switch_netns(rdev, net);
7000 7001 7002 7003 7004

	put_net(net);
	return err;
}

S
Samuel Ortiz 已提交
7005 7006
static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
{
7007
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
S
Samuel Ortiz 已提交
7008 7009
	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
			struct cfg80211_pmksa *pmksa) = NULL;
7010
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
7011 7012 7013 7014 7015 7016 7017 7018 7019 7020 7021 7022 7023
	struct cfg80211_pmksa pmksa;

	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!info->attrs[NL80211_ATTR_PMKID])
		return -EINVAL;

	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
	pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);

7024
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7025 7026
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7027 7028 7029 7030 7031 7032 7033 7034 7035 7036 7037 7038 7039

	switch (info->genlhdr->cmd) {
	case NL80211_CMD_SET_PMKSA:
		rdev_ops = rdev->ops->set_pmksa;
		break;
	case NL80211_CMD_DEL_PMKSA:
		rdev_ops = rdev->ops->del_pmksa;
		break;
	default:
		WARN_ON(1);
		break;
	}

7040 7041
	if (!rdev_ops)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7042

7043
	return rdev_ops(&rdev->wiphy, dev, &pmksa);
S
Samuel Ortiz 已提交
7044 7045 7046 7047
}

static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
{
7048 7049
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
S
Samuel Ortiz 已提交
7050

7051
	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7052 7053
	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7054

7055 7056
	if (!rdev->ops->flush_pmksa)
		return -EOPNOTSUPP;
S
Samuel Ortiz 已提交
7057

7058
	return rdev_flush_pmksa(rdev, dev);
S
Samuel Ortiz 已提交
7059 7060
}

7061 7062 7063 7064 7065 7066 7067 7068 7069 7070 7071 7072 7073 7074 7075 7076 7077 7078 7079 7080 7081 7082 7083 7084
static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	u8 action_code, dialog_token;
	u16 status_code;
	u8 *peer;

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
	    !rdev->ops->tdls_mgmt)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
	    !info->attrs[NL80211_ATTR_IE] ||
	    !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);

7085 7086 7087 7088
	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
			      dialog_token, status_code,
			      nla_data(info->attrs[NL80211_ATTR_IE]),
			      nla_len(info->attrs[NL80211_ATTR_IE]));
7089 7090 7091 7092 7093 7094 7095 7096 7097 7098 7099 7100 7101 7102 7103 7104 7105 7106 7107 7108
}

static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	enum nl80211_tdls_operation operation;
	u8 *peer;

	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
	    !rdev->ops->tdls_oper)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
	    !info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);

7109
	return rdev_tdls_oper(rdev, dev, peer, operation);
7110 7111
}

7112 7113 7114
static int nl80211_remain_on_channel(struct sk_buff *skb,
				     struct genl_info *info)
{
7115
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7116
	struct wireless_dev *wdev = info->user_ptr[1];
7117
	struct cfg80211_chan_def chandef;
7118 7119 7120
	struct sk_buff *msg;
	void *hdr;
	u64 cookie;
7121
	u32 duration;
7122 7123 7124 7125 7126 7127 7128 7129
	int err;

	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
	    !info->attrs[NL80211_ATTR_DURATION])
		return -EINVAL;

	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);

7130 7131 7132 7133
	if (!rdev->ops->remain_on_channel ||
	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
		return -EOPNOTSUPP;

7134
	/*
7135 7136
	 * We should be on that channel for at least a minimum amount of
	 * time (10ms) but no longer than the driver supports.
7137
	 */
7138
	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7139
	    duration > rdev->wiphy.max_remain_on_channel_duration)
7140 7141
		return -EINVAL;

7142 7143 7144
	err = nl80211_parse_chandef(rdev, info, &chandef);
	if (err)
		return err;
7145 7146

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7147 7148
	if (!msg)
		return -ENOMEM;
7149

7150
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7151
			     NL80211_CMD_REMAIN_ON_CHANNEL);
7152 7153
	if (!hdr) {
		err = -ENOBUFS;
7154 7155 7156
		goto free_msg;
	}

7157 7158
	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
				     duration, &cookie);
7159 7160 7161 7162

	if (err)
		goto free_msg;

7163 7164
	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
7165 7166

	genlmsg_end(msg, hdr);
7167 7168

	return genlmsg_reply(msg, info);
7169 7170 7171 7172 7173 7174 7175 7176 7177 7178 7179

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
					    struct genl_info *info)
{
7180
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7181
	struct wireless_dev *wdev = info->user_ptr[1];
7182 7183 7184 7185 7186
	u64 cookie;

	if (!info->attrs[NL80211_ATTR_COOKIE])
		return -EINVAL;

7187 7188
	if (!rdev->ops->cancel_remain_on_channel)
		return -EOPNOTSUPP;
7189 7190 7191

	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);

7192
	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7193 7194
}

7195 7196 7197 7198 7199 7200 7201 7202 7203 7204 7205 7206 7207 7208 7209 7210 7211 7212 7213 7214 7215 7216 7217 7218
static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
			   u8 *rates, u8 rates_len)
{
	u8 i;
	u32 mask = 0;

	for (i = 0; i < rates_len; i++) {
		int rate = (rates[i] & 0x7f) * 5;
		int ridx;
		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
			struct ieee80211_rate *srate =
				&sband->bitrates[ridx];
			if (rate == srate->bitrate) {
				mask |= 1 << ridx;
				break;
			}
		}
		if (ridx == sband->n_bitrates)
			return 0; /* rate not found */
	}

	return mask;
}

7219 7220 7221 7222 7223 7224 7225 7226 7227 7228 7229 7230 7231 7232 7233
static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
			       u8 *rates, u8 rates_len,
			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
{
	u8 i;

	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);

	for (i = 0; i < rates_len; i++) {
		int ridx, rbit;

		ridx = rates[i] / 8;
		rbit = BIT(rates[i] % 8);

		/* check validity */
7234
		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7235 7236 7237 7238 7239 7240 7241 7242 7243 7244 7245 7246
			return false;

		/* check availability */
		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
			mcs[ridx] |= rbit;
		else
			return false;
	}

	return true;
}

A
Alexey Dobriyan 已提交
7247
static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7248 7249
	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
				    .len = NL80211_MAX_SUPP_RATES },
7250 7251
	[NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
				 .len = NL80211_MAX_SUPP_HT_RATES },
7252 7253 7254 7255 7256 7257
};

static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7258
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7259
	struct cfg80211_bitrate_mask mask;
7260 7261
	int rem, i;
	struct net_device *dev = info->user_ptr[1];
7262 7263 7264 7265 7266 7267
	struct nlattr *tx_rates;
	struct ieee80211_supported_band *sband;

	if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
		return -EINVAL;

7268 7269
	if (!rdev->ops->set_bitrate_mask)
		return -EOPNOTSUPP;
7270 7271 7272 7273 7274 7275 7276

	memset(&mask, 0, sizeof(mask));
	/* Default to all rates enabled */
	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
		sband = rdev->wiphy.bands[i];
		mask.control[i].legacy =
			sband ? (1 << sband->n_bitrates) - 1 : 0;
7277 7278 7279 7280 7281 7282 7283
		if (sband)
			memcpy(mask.control[i].mcs,
			       sband->ht_cap.mcs.rx_mask,
			       sizeof(mask.control[i].mcs));
		else
			memset(mask.control[i].mcs, 0,
			       sizeof(mask.control[i].mcs));
7284 7285 7286 7287 7288 7289
	}

	/*
	 * The nested attribute uses enum nl80211_band as the index. This maps
	 * directly to the enum ieee80211_band values used in cfg80211.
	 */
7290
	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7291 7292 7293
	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
	{
		enum ieee80211_band band = nla_type(tx_rates);
7294 7295
		if (band < 0 || band >= IEEE80211_NUM_BANDS)
			return -EINVAL;
7296
		sband = rdev->wiphy.bands[band];
7297 7298
		if (sband == NULL)
			return -EINVAL;
7299 7300 7301 7302 7303 7304 7305
		nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
			  nla_len(tx_rates), nl80211_txattr_policy);
		if (tb[NL80211_TXRATE_LEGACY]) {
			mask.control[band].legacy = rateset_to_mask(
				sband,
				nla_data(tb[NL80211_TXRATE_LEGACY]),
				nla_len(tb[NL80211_TXRATE_LEGACY]));
7306 7307 7308
			if ((mask.control[band].legacy == 0) &&
			    nla_len(tb[NL80211_TXRATE_LEGACY]))
				return -EINVAL;
7309 7310 7311 7312 7313 7314 7315 7316 7317 7318 7319 7320 7321 7322 7323 7324 7325 7326 7327 7328 7329 7330
		}
		if (tb[NL80211_TXRATE_MCS]) {
			if (!ht_rateset_to_mask(
					sband,
					nla_data(tb[NL80211_TXRATE_MCS]),
					nla_len(tb[NL80211_TXRATE_MCS]),
					mask.control[band].mcs))
				return -EINVAL;
		}

		if (mask.control[band].legacy == 0) {
			/* don't allow empty legacy rates if HT
			 * is not even supported. */
			if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
				return -EINVAL;

			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
				if (mask.control[band].mcs[i])
					break;

			/* legacy and mcs rates may not be both empty */
			if (i == IEEE80211_HT_MCS_MASK_LEN)
7331
				return -EINVAL;
7332 7333 7334
		}
	}

7335
	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7336 7337
}

7338
static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7339
{
7340
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7341
	struct wireless_dev *wdev = info->user_ptr[1];
7342
	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7343 7344 7345 7346

	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
		return -EINVAL;

7347 7348
	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7349

7350 7351 7352 7353 7354 7355 7356 7357
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_MESH_POINT:
	case NL80211_IFTYPE_P2P_GO:
7358
	case NL80211_IFTYPE_P2P_DEVICE:
7359 7360
		break;
	default:
7361
		return -EOPNOTSUPP;
7362
	}
7363 7364

	/* not much point in registering if we can't reply */
7365 7366
	if (!rdev->ops->mgmt_tx)
		return -EOPNOTSUPP;
7367

7368
	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7369 7370 7371 7372
			nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
			nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
}

7373
static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7374
{
7375
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7376
	struct wireless_dev *wdev = info->user_ptr[1];
7377
	struct cfg80211_chan_def chandef;
7378
	int err;
J
Johannes Berg 已提交
7379
	void *hdr = NULL;
7380
	u64 cookie;
7381
	struct sk_buff *msg = NULL;
7382
	unsigned int wait = 0;
7383 7384 7385
	bool offchan, no_cck, dont_wait_for_ack;

	dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7386

7387
	if (!info->attrs[NL80211_ATTR_FRAME])
7388 7389
		return -EINVAL;

7390 7391
	if (!rdev->ops->mgmt_tx)
		return -EOPNOTSUPP;
7392

7393
	switch (wdev->iftype) {
7394 7395 7396
	case NL80211_IFTYPE_P2P_DEVICE:
		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
			return -EINVAL;
7397 7398 7399 7400 7401 7402 7403 7404 7405
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_MESH_POINT:
	case NL80211_IFTYPE_P2P_GO:
		break;
	default:
7406
		return -EOPNOTSUPP;
7407
	}
7408

7409
	if (info->attrs[NL80211_ATTR_DURATION]) {
7410
		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7411 7412
			return -EINVAL;
		wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7413 7414 7415 7416 7417 7418 7419 7420 7421

		/*
		 * We should wait on the channel for at least a minimum amount
		 * of time (10ms) but no longer than the driver supports.
		 */
		if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
		    wait > rdev->wiphy.max_remain_on_channel_duration)
			return -EINVAL;

7422 7423 7424 7425
	}

	offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];

7426 7427 7428
	if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
		return -EINVAL;

7429 7430
	no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);

7431 7432 7433 7434 7435 7436 7437 7438 7439 7440 7441 7442
	/* get the channel if any has been specified, otherwise pass NULL to
	 * the driver. The latter will use the current one
	 */
	chandef.chan = NULL;
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
		err = nl80211_parse_chandef(rdev, info, &chandef);
		if (err)
			return err;
	}

	if (!chandef.chan && offchan)
		return -EINVAL;
7443

7444 7445 7446 7447
	if (!dont_wait_for_ack) {
		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		if (!msg)
			return -ENOMEM;
7448

7449
		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7450
				     NL80211_CMD_FRAME);
7451 7452
		if (!hdr) {
			err = -ENOBUFS;
7453 7454
			goto free_msg;
		}
7455
	}
7456

7457
	err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7458 7459
				    nla_data(info->attrs[NL80211_ATTR_FRAME]),
				    nla_len(info->attrs[NL80211_ATTR_FRAME]),
7460
				    no_cck, dont_wait_for_ack, &cookie);
7461 7462 7463
	if (err)
		goto free_msg;

7464
	if (msg) {
7465 7466
		if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
			goto nla_put_failure;
7467

7468 7469 7470 7471 7472
		genlmsg_end(msg, hdr);
		return genlmsg_reply(msg, info);
	}

	return 0;
7473 7474 7475 7476 7477 7478 7479 7480

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

7481 7482 7483
static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7484
	struct wireless_dev *wdev = info->user_ptr[1];
7485 7486 7487 7488 7489 7490 7491 7492
	u64 cookie;

	if (!info->attrs[NL80211_ATTR_COOKIE])
		return -EINVAL;

	if (!rdev->ops->mgmt_tx_cancel_wait)
		return -EOPNOTSUPP;

7493 7494 7495 7496 7497 7498 7499
	switch (wdev->iftype) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_ADHOC:
	case NL80211_IFTYPE_P2P_CLIENT:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_P2P_GO:
7500
	case NL80211_IFTYPE_P2P_DEVICE:
7501 7502
		break;
	default:
7503
		return -EOPNOTSUPP;
7504
	}
7505 7506 7507

	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);

7508
	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7509 7510
}

K
Kalle Valo 已提交
7511 7512
static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
{
7513
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
K
Kalle Valo 已提交
7514
	struct wireless_dev *wdev;
7515
	struct net_device *dev = info->user_ptr[1];
K
Kalle Valo 已提交
7516 7517 7518 7519
	u8 ps_state;
	bool state;
	int err;

7520 7521
	if (!info->attrs[NL80211_ATTR_PS_STATE])
		return -EINVAL;
K
Kalle Valo 已提交
7522 7523 7524

	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);

7525 7526
	if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
		return -EINVAL;
K
Kalle Valo 已提交
7527 7528 7529

	wdev = dev->ieee80211_ptr;

7530 7531
	if (!rdev->ops->set_power_mgmt)
		return -EOPNOTSUPP;
K
Kalle Valo 已提交
7532 7533 7534 7535

	state = (ps_state == NL80211_PS_ENABLED) ? true : false;

	if (state == wdev->ps)
7536
		return 0;
K
Kalle Valo 已提交
7537

7538
	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7539 7540
	if (!err)
		wdev->ps = state;
K
Kalle Valo 已提交
7541 7542 7543 7544 7545
	return err;
}

static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
{
7546
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
K
Kalle Valo 已提交
7547 7548
	enum nl80211_ps_state ps_state;
	struct wireless_dev *wdev;
7549
	struct net_device *dev = info->user_ptr[1];
K
Kalle Valo 已提交
7550 7551 7552 7553 7554 7555
	struct sk_buff *msg;
	void *hdr;
	int err;

	wdev = dev->ieee80211_ptr;

7556 7557
	if (!rdev->ops->set_power_mgmt)
		return -EOPNOTSUPP;
K
Kalle Valo 已提交
7558 7559

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7560 7561
	if (!msg)
		return -ENOMEM;
K
Kalle Valo 已提交
7562

7563
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
K
Kalle Valo 已提交
7564 7565
			     NL80211_CMD_GET_POWER_SAVE);
	if (!hdr) {
7566
		err = -ENOBUFS;
K
Kalle Valo 已提交
7567 7568 7569 7570 7571 7572 7573 7574
		goto free_msg;
	}

	if (wdev->ps)
		ps_state = NL80211_PS_ENABLED;
	else
		ps_state = NL80211_PS_DISABLED;

7575 7576
	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
		goto nla_put_failure;
K
Kalle Valo 已提交
7577 7578

	genlmsg_end(msg, hdr);
7579
	return genlmsg_reply(msg, info);
K
Kalle Valo 已提交
7580

7581
 nla_put_failure:
K
Kalle Valo 已提交
7582
	err = -ENOBUFS;
7583
 free_msg:
K
Kalle Valo 已提交
7584 7585 7586 7587
	nlmsg_free(msg);
	return err;
}

7588 7589 7590 7591 7592
static struct nla_policy
nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7593 7594 7595
	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7596 7597
};

7598
static int nl80211_set_cqm_txe(struct genl_info *info,
J
Johannes Berg 已提交
7599
			       u32 rate, u32 pkts, u32 intvl)
7600 7601 7602
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7603
	struct wireless_dev *wdev = dev->ieee80211_ptr;
7604

J
Johannes Berg 已提交
7605
	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7606 7607 7608 7609 7610 7611 7612 7613 7614
		return -EINVAL;

	if (!rdev->ops->set_cqm_txe_config)
		return -EOPNOTSUPP;

	if (wdev->iftype != NL80211_IFTYPE_STATION &&
	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;

7615
	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7616 7617
}

7618 7619 7620
static int nl80211_set_cqm_rssi(struct genl_info *info,
				s32 threshold, u32 hysteresis)
{
7621 7622
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
7623
	struct wireless_dev *wdev = dev->ieee80211_ptr;
7624 7625 7626 7627

	if (threshold > 0)
		return -EINVAL;

7628 7629 7630
	/* disabling - hysteresis should also be zero then */
	if (threshold == 0)
		hysteresis = 0;
7631

7632 7633
	if (!rdev->ops->set_cqm_rssi_config)
		return -EOPNOTSUPP;
7634

7635
	if (wdev->iftype != NL80211_IFTYPE_STATION &&
7636 7637
	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
		return -EOPNOTSUPP;
7638

7639
	return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7640 7641 7642 7643 7644 7645 7646 7647 7648
}

static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
{
	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
	struct nlattr *cqm;
	int err;

	cqm = info->attrs[NL80211_ATTR_CQM];
7649 7650
	if (!cqm)
		return -EINVAL;
7651 7652 7653 7654

	err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
			       nl80211_attr_cqm_policy);
	if (err)
7655
		return err;
7656 7657 7658

	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7659 7660
		s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7661

7662 7663 7664 7665 7666 7667 7668 7669 7670 7671 7672 7673 7674 7675
		return nl80211_set_cqm_rssi(info, threshold, hysteresis);
	}

	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);

		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
	}

	return -EINVAL;
7676 7677
}

7678 7679 7680 7681 7682
static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct mesh_config cfg;
7683
	struct mesh_setup setup;
7684 7685 7686 7687
	int err;

	/* start with default */
	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7688
	memcpy(&setup, &default_mesh_setup, sizeof(setup));
7689

7690
	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7691
		/* and parse parameters if given */
7692
		err = nl80211_parse_mesh_config(info, &cfg, NULL);
7693 7694 7695 7696 7697 7698 7699 7700
		if (err)
			return err;
	}

	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
		return -EINVAL;

7701 7702 7703
	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);

7704 7705 7706 7707 7708
	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
			return -EINVAL;

7709 7710 7711 7712 7713 7714 7715 7716 7717 7718 7719 7720 7721 7722 7723
	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
		setup.beacon_interval =
			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
		if (setup.beacon_interval < 10 ||
		    setup.beacon_interval > 10000)
			return -EINVAL;
	}

	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
		setup.dtim_period =
			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
		if (setup.dtim_period < 1 || setup.dtim_period > 100)
			return -EINVAL;
	}

7724 7725 7726 7727 7728 7729 7730
	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
		/* parse additional setup parameters if given */
		err = nl80211_parse_mesh_setup(info, &setup);
		if (err)
			return err;
	}

7731 7732 7733
	if (setup.user_mpm)
		cfg.auto_open_plinks = false;

7734
	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7735 7736 7737
		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
		if (err)
			return err;
7738 7739
	} else {
		/* cfg80211_join_mesh() will sort it out */
7740
		setup.chandef.chan = NULL;
7741 7742
	}

7743 7744 7745 7746 7747 7748 7749 7750 7751 7752 7753 7754 7755 7756 7757 7758 7759
	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		int n_rates =
			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
		struct ieee80211_supported_band *sband;

		if (!setup.chandef.chan)
			return -EINVAL;

		sband = rdev->wiphy.bands[setup.chandef.chan->band];

		err = ieee80211_get_ratemask(sband, rates, n_rates,
					     &setup.basic_rates);
		if (err)
			return err;
	}

7760
	return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7761 7762 7763 7764 7765 7766 7767 7768 7769 7770
}

static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];

	return cfg80211_leave_mesh(rdev, dev);
}

7771
#ifdef CONFIG_PM
7772 7773 7774
static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
					struct cfg80211_registered_device *rdev)
{
7775
	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7776 7777 7778
	struct nlattr *nl_pats, *nl_pat;
	int i, pat_len;

7779
	if (!wowlan->n_patterns)
7780 7781 7782 7783 7784 7785
		return 0;

	nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
	if (!nl_pats)
		return -ENOBUFS;

7786
	for (i = 0; i < wowlan->n_patterns; i++) {
7787 7788 7789
		nl_pat = nla_nest_start(msg, i + 1);
		if (!nl_pat)
			return -ENOBUFS;
7790
		pat_len = wowlan->patterns[i].pattern_len;
7791
		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
7792
			    wowlan->patterns[i].mask) ||
7793 7794 7795
		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
			    wowlan->patterns[i].pattern) ||
		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
7796
				wowlan->patterns[i].pkt_offset))
7797 7798 7799 7800 7801 7802 7803 7804
			return -ENOBUFS;
		nla_nest_end(msg, nl_pat);
	}
	nla_nest_end(msg, nl_pats);

	return 0;
}

7805 7806 7807 7808 7809 7810 7811 7812 7813 7814 7815 7816 7817 7818 7819 7820 7821 7822 7823 7824 7825 7826 7827 7828 7829 7830 7831 7832 7833 7834 7835 7836 7837 7838 7839 7840 7841 7842
static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
				   struct cfg80211_wowlan_tcp *tcp)
{
	struct nlattr *nl_tcp;

	if (!tcp)
		return 0;

	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
	if (!nl_tcp)
		return -ENOBUFS;

	if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
	    nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
		    tcp->payload_len, tcp->payload) ||
	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
			tcp->data_interval) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
		    tcp->wake_len, tcp->wake_data) ||
	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
		return -ENOBUFS;

	if (tcp->payload_seq.len &&
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
		    sizeof(tcp->payload_seq), &tcp->payload_seq))
		return -ENOBUFS;

	if (tcp->payload_tok.len &&
	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
		    sizeof(tcp->payload_tok) + tcp->tokens_size,
		    &tcp->payload_tok))
		return -ENOBUFS;

7843 7844
	nla_nest_end(msg, nl_tcp);

7845 7846 7847
	return 0;
}

J
Johannes Berg 已提交
7848 7849 7850 7851 7852
static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct sk_buff *msg;
	void *hdr;
7853
	u32 size = NLMSG_DEFAULT_SIZE;
J
Johannes Berg 已提交
7854

7855
	if (!rdev->wiphy.wowlan)
J
Johannes Berg 已提交
7856 7857
		return -EOPNOTSUPP;

7858
	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7859
		/* adjust size to have room for all the data */
7860 7861 7862 7863
		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
			rdev->wiphy.wowlan_config->tcp->payload_len +
			rdev->wiphy.wowlan_config->tcp->wake_len +
			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7864 7865 7866
	}

	msg = nlmsg_new(size, GFP_KERNEL);
J
Johannes Berg 已提交
7867 7868 7869
	if (!msg)
		return -ENOMEM;

7870
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
J
Johannes Berg 已提交
7871 7872 7873 7874
			     NL80211_CMD_GET_WOWLAN);
	if (!hdr)
		goto nla_put_failure;

7875
	if (rdev->wiphy.wowlan_config) {
J
Johannes Berg 已提交
7876 7877 7878 7879 7880 7881
		struct nlattr *nl_wowlan;

		nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
		if (!nl_wowlan)
			goto nla_put_failure;

7882
		if ((rdev->wiphy.wowlan_config->any &&
7883
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7884
		    (rdev->wiphy.wowlan_config->disconnect &&
7885
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7886
		    (rdev->wiphy.wowlan_config->magic_pkt &&
7887
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7888
		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7889
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7890
		    (rdev->wiphy.wowlan_config->eap_identity_req &&
7891
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7892
		    (rdev->wiphy.wowlan_config->four_way_handshake &&
7893
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7894
		    (rdev->wiphy.wowlan_config->rfkill_release &&
7895 7896
		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
			goto nla_put_failure;
7897

7898 7899
		if (nl80211_send_wowlan_patterns(msg, rdev))
			goto nla_put_failure;
7900

7901 7902
		if (nl80211_send_wowlan_tcp(msg,
					    rdev->wiphy.wowlan_config->tcp))
7903 7904
			goto nla_put_failure;

J
Johannes Berg 已提交
7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915
		nla_nest_end(msg, nl_wowlan);
	}

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

nla_put_failure:
	nlmsg_free(msg);
	return -ENOBUFS;
}

7916 7917 7918 7919 7920 7921 7922 7923 7924 7925 7926 7927
static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
				    struct nlattr *attr,
				    struct cfg80211_wowlan *trig)
{
	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
	struct cfg80211_wowlan_tcp *cfg;
	struct nl80211_wowlan_tcp_data_token *tok = NULL;
	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
	u32 size;
	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
	int err, port;

7928
	if (!rdev->wiphy.wowlan->tcp)
7929 7930 7931 7932 7933 7934 7935 7936 7937 7938 7939 7940 7941 7942 7943 7944 7945 7946 7947
		return -EINVAL;

	err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
			nla_data(attr), nla_len(attr),
			nl80211_wowlan_tcp_policy);
	if (err)
		return err;

	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
		return -EINVAL;

	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7948
	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
7949 7950 7951
		return -EINVAL;

	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7952
			rdev->wiphy.wowlan->tcp->data_interval_max ||
7953
	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7954 7955 7956
		return -EINVAL;

	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7957
	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
7958 7959 7960 7961 7962 7963 7964 7965 7966 7967 7968 7969 7970 7971
		return -EINVAL;

	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
		return -EINVAL;

	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);

		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
		tokens_size = tokln - sizeof(*tok);

		if (!tok->len || tokens_size % tok->len)
			return -EINVAL;
7972
		if (!rdev->wiphy.wowlan->tcp->tok)
7973
			return -EINVAL;
7974
		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
7975
			return -EINVAL;
7976
		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
7977
			return -EINVAL;
7978
		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
7979 7980 7981 7982 7983 7984 7985
			return -EINVAL;
		if (tok->offset + tok->len > data_size)
			return -EINVAL;
	}

	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7986
		if (!rdev->wiphy.wowlan->tcp->seq)
7987 7988 7989 7990 7991 7992 7993 7994 7995 7996 7997 7998 7999 8000 8001 8002 8003 8004 8005 8006 8007 8008 8009 8010 8011 8012 8013 8014 8015 8016 8017 8018 8019 8020 8021 8022 8023 8024 8025 8026 8027 8028 8029 8030 8031 8032 8033 8034 8035 8036 8037 8038 8039 8040 8041 8042 8043 8044 8045 8046 8047 8048 8049 8050 8051 8052 8053 8054 8055 8056 8057 8058 8059 8060
			return -EINVAL;
		if (seq->len == 0 || seq->len > 4)
			return -EINVAL;
		if (seq->len + seq->offset > data_size)
			return -EINVAL;
	}

	size = sizeof(*cfg);
	size += data_size;
	size += wake_size + wake_mask_size;
	size += tokens_size;

	cfg = kzalloc(size, GFP_KERNEL);
	if (!cfg)
		return -ENOMEM;
	cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
	cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
	       ETH_ALEN);
	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
	else
		port = 0;
#ifdef CONFIG_INET
	/* allocate a socket and port for it and use it */
	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
			    IPPROTO_TCP, &cfg->sock, 1);
	if (err) {
		kfree(cfg);
		return err;
	}
	if (inet_csk_get_port(cfg->sock->sk, port)) {
		sock_release(cfg->sock);
		kfree(cfg);
		return -EADDRINUSE;
	}
	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
#else
	if (!port) {
		kfree(cfg);
		return -EINVAL;
	}
	cfg->src_port = port;
#endif

	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
	cfg->payload_len = data_size;
	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
	memcpy((void *)cfg->payload,
	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
	       data_size);
	if (seq)
		cfg->payload_seq = *seq;
	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
	cfg->wake_len = wake_size;
	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
	memcpy((void *)cfg->wake_data,
	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
	       wake_size);
	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
			 data_size + wake_size;
	memcpy((void *)cfg->wake_mask,
	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
	       wake_mask_size);
	if (tok) {
		cfg->tokens_size = tokens_size;
		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
	}

	trig->tcp = cfg;

	return 0;
}

J
Johannes Berg 已提交
8061 8062 8063 8064 8065
static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
	struct cfg80211_wowlan new_triggers = {};
8066
	struct cfg80211_wowlan *ntrig;
8067
	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
J
Johannes Berg 已提交
8068
	int err, i;
8069
	bool prev_enabled = rdev->wiphy.wowlan_config;
J
Johannes Berg 已提交
8070

8071
	if (!wowlan)
J
Johannes Berg 已提交
8072 8073
		return -EOPNOTSUPP;

8074 8075
	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
		cfg80211_rdev_free_wowlan(rdev);
8076
		rdev->wiphy.wowlan_config = NULL;
8077 8078
		goto set_wakeup;
	}
J
Johannes Berg 已提交
8079 8080 8081 8082 8083 8084 8085 8086 8087 8088 8089 8090 8091 8092 8093 8094 8095 8096 8097 8098 8099 8100 8101 8102 8103 8104

	err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
			nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
			nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
			nl80211_wowlan_policy);
	if (err)
		return err;

	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
			return -EINVAL;
		new_triggers.any = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
			return -EINVAL;
		new_triggers.disconnect = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
			return -EINVAL;
		new_triggers.magic_pkt = true;
	}

8105 8106 8107 8108 8109 8110 8111 8112 8113 8114 8115 8116 8117 8118 8119 8120 8121 8122 8123 8124 8125 8126 8127 8128 8129 8130 8131
	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
		return -EINVAL;

	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
			return -EINVAL;
		new_triggers.gtk_rekey_failure = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
			return -EINVAL;
		new_triggers.eap_identity_req = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
			return -EINVAL;
		new_triggers.four_way_handshake = true;
	}

	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
			return -EINVAL;
		new_triggers.rfkill_release = true;
	}

J
Johannes Berg 已提交
8132 8133 8134
	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
		struct nlattr *pat;
		int n_patterns = 0;
8135
		int rem, pat_len, mask_len, pkt_offset;
8136
		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
J
Johannes Berg 已提交
8137 8138 8139 8140 8141 8142 8143 8144 8145 8146 8147 8148 8149 8150 8151 8152 8153 8154

		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
				    rem)
			n_patterns++;
		if (n_patterns > wowlan->n_patterns)
			return -EINVAL;

		new_triggers.patterns = kcalloc(n_patterns,
						sizeof(new_triggers.patterns[0]),
						GFP_KERNEL);
		if (!new_triggers.patterns)
			return -ENOMEM;

		new_triggers.n_patterns = n_patterns;
		i = 0;

		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
				    rem) {
8155 8156
			nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
				  nla_len(pat), NULL);
J
Johannes Berg 已提交
8157
			err = -EINVAL;
8158 8159
			if (!pat_tb[NL80211_PKTPAT_MASK] ||
			    !pat_tb[NL80211_PKTPAT_PATTERN])
J
Johannes Berg 已提交
8160
				goto error;
8161
			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
J
Johannes Berg 已提交
8162
			mask_len = DIV_ROUND_UP(pat_len, 8);
8163
			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
J
Johannes Berg 已提交
8164 8165 8166 8167 8168
				goto error;
			if (pat_len > wowlan->pattern_max_len ||
			    pat_len < wowlan->pattern_min_len)
				goto error;

8169
			if (!pat_tb[NL80211_PKTPAT_OFFSET])
8170 8171 8172
				pkt_offset = 0;
			else
				pkt_offset = nla_get_u32(
8173
					pat_tb[NL80211_PKTPAT_OFFSET]);
8174 8175 8176 8177
			if (pkt_offset > wowlan->max_pkt_offset)
				goto error;
			new_triggers.patterns[i].pkt_offset = pkt_offset;

J
Johannes Berg 已提交
8178 8179 8180 8181 8182 8183 8184 8185 8186
			new_triggers.patterns[i].mask =
				kmalloc(mask_len + pat_len, GFP_KERNEL);
			if (!new_triggers.patterns[i].mask) {
				err = -ENOMEM;
				goto error;
			}
			new_triggers.patterns[i].pattern =
				new_triggers.patterns[i].mask + mask_len;
			memcpy(new_triggers.patterns[i].mask,
8187
			       nla_data(pat_tb[NL80211_PKTPAT_MASK]),
J
Johannes Berg 已提交
8188 8189 8190
			       mask_len);
			new_triggers.patterns[i].pattern_len = pat_len;
			memcpy(new_triggers.patterns[i].pattern,
8191
			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
J
Johannes Berg 已提交
8192 8193 8194 8195 8196
			       pat_len);
			i++;
		}
	}

8197 8198 8199 8200 8201 8202 8203 8204
	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
		err = nl80211_parse_wowlan_tcp(
			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
			&new_triggers);
		if (err)
			goto error;
	}

8205 8206 8207 8208
	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
	if (!ntrig) {
		err = -ENOMEM;
		goto error;
J
Johannes Berg 已提交
8209
	}
8210
	cfg80211_rdev_free_wowlan(rdev);
8211
	rdev->wiphy.wowlan_config = ntrig;
J
Johannes Berg 已提交
8212

8213
 set_wakeup:
8214 8215 8216
	if (rdev->ops->set_wakeup &&
	    prev_enabled != !!rdev->wiphy.wowlan_config)
		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8217

J
Johannes Berg 已提交
8218 8219 8220 8221 8222
	return 0;
 error:
	for (i = 0; i < new_triggers.n_patterns; i++)
		kfree(new_triggers.patterns[i].mask);
	kfree(new_triggers.patterns);
8223 8224 8225
	if (new_triggers.tcp && new_triggers.tcp->sock)
		sock_release(new_triggers.tcp->sock);
	kfree(new_triggers.tcp);
J
Johannes Berg 已提交
8226 8227
	return err;
}
8228
#endif
J
Johannes Berg 已提交
8229

8230 8231 8232 8233 8234 8235 8236 8237 8238 8239 8240 8241 8242 8243 8244 8245 8246 8247 8248 8249 8250 8251 8252 8253 8254 8255 8256 8257 8258 8259 8260 8261 8262 8263 8264 8265 8266 8267 8268 8269 8270 8271 8272 8273 8274 8275 8276 8277 8278 8279 8280 8281 8282 8283 8284 8285 8286 8287 8288 8289 8290 8291 8292 8293 8294 8295 8296 8297 8298 8299 8300 8301 8302 8303 8304 8305 8306 8307 8308 8309 8310 8311 8312 8313 8314 8315 8316 8317 8318 8319 8320 8321 8322 8323 8324 8325 8326 8327 8328 8329 8330 8331 8332 8333 8334 8335 8336 8337 8338 8339 8340 8341 8342 8343 8344 8345 8346 8347 8348 8349 8350 8351 8352 8353 8354 8355 8356 8357 8358 8359 8360 8361 8362 8363 8364 8365 8366 8367 8368 8369 8370 8371 8372 8373 8374 8375 8376 8377 8378 8379 8380 8381 8382 8383 8384 8385 8386 8387 8388 8389 8390 8391 8392 8393 8394 8395 8396 8397 8398 8399 8400 8401 8402 8403 8404 8405 8406 8407 8408 8409 8410 8411 8412 8413 8414 8415 8416 8417 8418 8419 8420 8421 8422 8423 8424 8425 8426 8427 8428 8429 8430 8431 8432 8433 8434 8435 8436 8437 8438 8439 8440 8441 8442 8443 8444 8445 8446 8447 8448 8449 8450 8451 8452 8453 8454 8455 8456 8457 8458 8459 8460 8461 8462 8463 8464 8465 8466 8467 8468 8469 8470 8471 8472 8473 8474 8475 8476 8477 8478 8479 8480 8481 8482 8483 8484 8485 8486 8487
static int nl80211_send_coalesce_rules(struct sk_buff *msg,
				       struct cfg80211_registered_device *rdev)
{
	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
	int i, j, pat_len;
	struct cfg80211_coalesce_rules *rule;

	if (!rdev->coalesce->n_rules)
		return 0;

	nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
	if (!nl_rules)
		return -ENOBUFS;

	for (i = 0; i < rdev->coalesce->n_rules; i++) {
		nl_rule = nla_nest_start(msg, i + 1);
		if (!nl_rule)
			return -ENOBUFS;

		rule = &rdev->coalesce->rules[i];
		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
				rule->delay))
			return -ENOBUFS;

		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
				rule->condition))
			return -ENOBUFS;

		nl_pats = nla_nest_start(msg,
				NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
		if (!nl_pats)
			return -ENOBUFS;

		for (j = 0; j < rule->n_patterns; j++) {
			nl_pat = nla_nest_start(msg, j + 1);
			if (!nl_pat)
				return -ENOBUFS;
			pat_len = rule->patterns[j].pattern_len;
			if (nla_put(msg, NL80211_PKTPAT_MASK,
				    DIV_ROUND_UP(pat_len, 8),
				    rule->patterns[j].mask) ||
			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
				    rule->patterns[j].pattern) ||
			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
					rule->patterns[j].pkt_offset))
				return -ENOBUFS;
			nla_nest_end(msg, nl_pat);
		}
		nla_nest_end(msg, nl_pats);
		nla_nest_end(msg, nl_rule);
	}
	nla_nest_end(msg, nl_rules);

	return 0;
}

static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct sk_buff *msg;
	void *hdr;

	if (!rdev->wiphy.coalesce)
		return -EOPNOTSUPP;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
			     NL80211_CMD_GET_COALESCE);
	if (!hdr)
		goto nla_put_failure;

	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

nla_put_failure:
	nlmsg_free(msg);
	return -ENOBUFS;
}

void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
{
	struct cfg80211_coalesce *coalesce = rdev->coalesce;
	int i, j;
	struct cfg80211_coalesce_rules *rule;

	if (!coalesce)
		return;

	for (i = 0; i < coalesce->n_rules; i++) {
		rule = &coalesce->rules[i];
		for (j = 0; j < rule->n_patterns; j++)
			kfree(rule->patterns[j].mask);
		kfree(rule->patterns);
	}
	kfree(coalesce->rules);
	kfree(coalesce);
	rdev->coalesce = NULL;
}

static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
				       struct nlattr *rule,
				       struct cfg80211_coalesce_rules *new_rule)
{
	int err, i;
	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];

	err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
			nla_len(rule), nl80211_coalesce_policy);
	if (err)
		return err;

	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
		new_rule->delay =
			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
	if (new_rule->delay > coalesce->max_delay)
		return -EINVAL;

	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
		new_rule->condition =
			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
	if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
	    new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
		return -EINVAL;

	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
		return -EINVAL;

	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
			    rem)
		n_patterns++;
	if (n_patterns > coalesce->n_patterns)
		return -EINVAL;

	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
				     GFP_KERNEL);
	if (!new_rule->patterns)
		return -ENOMEM;

	new_rule->n_patterns = n_patterns;
	i = 0;

	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
			    rem) {
		nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
			  nla_len(pat), NULL);
		if (!pat_tb[NL80211_PKTPAT_MASK] ||
		    !pat_tb[NL80211_PKTPAT_PATTERN])
			return -EINVAL;
		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
		mask_len = DIV_ROUND_UP(pat_len, 8);
		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
			return -EINVAL;
		if (pat_len > coalesce->pattern_max_len ||
		    pat_len < coalesce->pattern_min_len)
			return -EINVAL;

		if (!pat_tb[NL80211_PKTPAT_OFFSET])
			pkt_offset = 0;
		else
			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
		if (pkt_offset > coalesce->max_pkt_offset)
			return -EINVAL;
		new_rule->patterns[i].pkt_offset = pkt_offset;

		new_rule->patterns[i].mask =
			kmalloc(mask_len + pat_len, GFP_KERNEL);
		if (!new_rule->patterns[i].mask)
			return -ENOMEM;
		new_rule->patterns[i].pattern =
			new_rule->patterns[i].mask + mask_len;
		memcpy(new_rule->patterns[i].mask,
		       nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
		new_rule->patterns[i].pattern_len = pat_len;
		memcpy(new_rule->patterns[i].pattern,
		       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
		i++;
	}

	return 0;
}

static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
	struct cfg80211_coalesce new_coalesce = {};
	struct cfg80211_coalesce *n_coalesce;
	int err, rem_rule, n_rules = 0, i, j;
	struct nlattr *rule;
	struct cfg80211_coalesce_rules *tmp_rule;

	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
		cfg80211_rdev_free_coalesce(rdev);
		rdev->ops->set_coalesce(&rdev->wiphy, NULL);
		return 0;
	}

	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
			    rem_rule)
		n_rules++;
	if (n_rules > coalesce->n_rules)
		return -EINVAL;

	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
				     GFP_KERNEL);
	if (!new_coalesce.rules)
		return -ENOMEM;

	new_coalesce.n_rules = n_rules;
	i = 0;

	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
			    rem_rule) {
		err = nl80211_parse_coalesce_rule(rdev, rule,
						  &new_coalesce.rules[i]);
		if (err)
			goto error;

		i++;
	}

	err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
	if (err)
		goto error;

	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
	if (!n_coalesce) {
		err = -ENOMEM;
		goto error;
	}
	cfg80211_rdev_free_coalesce(rdev);
	rdev->coalesce = n_coalesce;

	return 0;
error:
	for (i = 0; i < new_coalesce.n_rules; i++) {
		tmp_rule = &new_coalesce.rules[i];
		for (j = 0; j < tmp_rule->n_patterns; j++)
			kfree(tmp_rule->patterns[j].mask);
		kfree(tmp_rule->patterns);
	}
	kfree(new_coalesce.rules);

	return err;
}

8488 8489 8490 8491 8492 8493 8494 8495 8496 8497 8498 8499 8500 8501 8502 8503 8504 8505 8506 8507 8508 8509 8510 8511 8512 8513 8514 8515 8516 8517 8518 8519 8520 8521 8522 8523 8524 8525 8526 8527 8528 8529 8530 8531 8532
static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
	struct cfg80211_gtk_rekey_data rekey_data;
	int err;

	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
		return -EINVAL;

	err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
			nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
			nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
			nl80211_rekey_policy);
	if (err)
		return err;

	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
		return -ERANGE;
	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
		return -ERANGE;
	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
		return -ERANGE;

	memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
	       NL80211_KEK_LEN);
	memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
	       NL80211_KCK_LEN);
	memcpy(rekey_data.replay_ctr,
	       nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
	       NL80211_REPLAY_CTR_LEN);

	wdev_lock(wdev);
	if (!wdev->current_bss) {
		err = -ENOTCONN;
		goto out;
	}

	if (!rdev->ops->set_rekey_data) {
		err = -EOPNOTSUPP;
		goto out;
	}

8533
	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8534 8535 8536 8537 8538
 out:
	wdev_unlock(wdev);
	return err;
}

8539 8540 8541 8542 8543 8544 8545 8546 8547 8548
static int nl80211_register_unexpected_frame(struct sk_buff *skb,
					     struct genl_info *info)
{
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;

	if (wdev->iftype != NL80211_IFTYPE_AP &&
	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
		return -EINVAL;

8549
	if (wdev->ap_unexpected_nlportid)
8550 8551
		return -EBUSY;

8552
	wdev->ap_unexpected_nlportid = info->snd_portid;
8553 8554 8555
	return 0;
}

J
Johannes Berg 已提交
8556 8557 8558 8559 8560 8561 8562 8563 8564 8565 8566 8567 8568 8569 8570 8571 8572 8573 8574 8575 8576 8577 8578 8579 8580 8581
static int nl80211_probe_client(struct sk_buff *skb,
				struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct net_device *dev = info->user_ptr[1];
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct sk_buff *msg;
	void *hdr;
	const u8 *addr;
	u64 cookie;
	int err;

	if (wdev->iftype != NL80211_IFTYPE_AP &&
	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_MAC])
		return -EINVAL;

	if (!rdev->ops->probe_client)
		return -EOPNOTSUPP;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

8582
	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
J
Johannes Berg 已提交
8583
			     NL80211_CMD_PROBE_CLIENT);
8584 8585
	if (!hdr) {
		err = -ENOBUFS;
J
Johannes Berg 已提交
8586 8587 8588 8589 8590
		goto free_msg;
	}

	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);

8591
	err = rdev_probe_client(rdev, dev, addr, &cookie);
J
Johannes Berg 已提交
8592 8593 8594
	if (err)
		goto free_msg;

8595 8596
	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
J
Johannes Berg 已提交
8597 8598 8599 8600 8601 8602 8603 8604 8605 8606 8607 8608

	genlmsg_end(msg, hdr);

	return genlmsg_reply(msg, info);

 nla_put_failure:
	err = -ENOBUFS;
 free_msg:
	nlmsg_free(msg);
	return err;
}

8609 8610 8611
static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8612 8613
	struct cfg80211_beacon_registration *reg, *nreg;
	int rv;
8614 8615 8616 8617

	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
		return -EOPNOTSUPP;

8618 8619 8620 8621 8622 8623 8624 8625 8626 8627 8628 8629 8630 8631 8632
	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
	if (!nreg)
		return -ENOMEM;

	/* First, check if already registered. */
	spin_lock_bh(&rdev->beacon_registrations_lock);
	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
		if (reg->nlportid == info->snd_portid) {
			rv = -EALREADY;
			goto out_err;
		}
	}
	/* Add it to the list */
	nreg->nlportid = info->snd_portid;
	list_add(&nreg->list, &rdev->beacon_registrations);
8633

8634
	spin_unlock_bh(&rdev->beacon_registrations_lock);
8635 8636

	return 0;
8637 8638 8639 8640
out_err:
	spin_unlock_bh(&rdev->beacon_registrations_lock);
	kfree(nreg);
	return rv;
8641 8642
}

8643 8644 8645 8646 8647 8648 8649 8650 8651 8652 8653 8654 8655 8656 8657 8658 8659 8660 8661
static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];
	int err;

	if (!rdev->ops->start_p2p_device)
		return -EOPNOTSUPP;

	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
		return -EOPNOTSUPP;

	if (wdev->p2p_started)
		return 0;

	err = cfg80211_can_add_interface(rdev, wdev->iftype);
	if (err)
		return err;

8662
	err = rdev_start_p2p_device(rdev, wdev);
8663 8664 8665 8666 8667 8668 8669 8670 8671 8672 8673 8674 8675 8676 8677 8678 8679 8680 8681 8682
	if (err)
		return err;

	wdev->p2p_started = true;
	rdev->opencount++;

	return 0;
}

static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];

	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
		return -EOPNOTSUPP;

	if (!rdev->ops->stop_p2p_device)
		return -EOPNOTSUPP;

8683
	cfg80211_stop_p2p_device(rdev, wdev);
8684 8685 8686 8687

	return 0;
}

8688 8689 8690 8691 8692 8693 8694 8695 8696 8697 8698 8699 8700 8701 8702 8703 8704 8705 8706 8707 8708 8709 8710 8711 8712 8713 8714
static int nl80211_get_protocol_features(struct sk_buff *skb,
					 struct genl_info *info)
{
	void *hdr;
	struct sk_buff *msg;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return -ENOMEM;

	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
			     NL80211_CMD_GET_PROTOCOL_FEATURES);
	if (!hdr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);
	return genlmsg_reply(msg, info);

 nla_put_failure:
	kfree_skb(msg);
	return -ENOBUFS;
}

8715 8716 8717 8718 8719 8720 8721 8722 8723 8724 8725 8726 8727 8728 8729 8730 8731 8732 8733 8734 8735
static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct cfg80211_update_ft_ies_params ft_params;
	struct net_device *dev = info->user_ptr[1];

	if (!rdev->ops->update_ft_ies)
		return -EOPNOTSUPP;

	if (!info->attrs[NL80211_ATTR_MDID] ||
	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
		return -EINVAL;

	memset(&ft_params, 0, sizeof(ft_params));
	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);

	return rdev_update_ft_ies(rdev, dev, &ft_params);
}

8736 8737 8738 8739 8740 8741 8742 8743 8744 8745 8746 8747 8748 8749 8750 8751 8752 8753 8754 8755 8756 8757 8758 8759 8760 8761 8762 8763 8764 8765 8766 8767 8768 8769 8770 8771 8772 8773 8774 8775 8776 8777 8778 8779 8780 8781 8782 8783 8784 8785 8786 8787 8788 8789 8790 8791 8792 8793
static int nl80211_crit_protocol_start(struct sk_buff *skb,
				       struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];
	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
	u16 duration;
	int ret;

	if (!rdev->ops->crit_proto_start)
		return -EOPNOTSUPP;

	if (WARN_ON(!rdev->ops->crit_proto_stop))
		return -EINVAL;

	if (rdev->crit_proto_nlportid)
		return -EBUSY;

	/* determine protocol if provided */
	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);

	if (proto >= NUM_NL80211_CRIT_PROTO)
		return -EINVAL;

	/* timeout must be provided */
	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
		return -EINVAL;

	duration =
		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);

	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
		return -ERANGE;

	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
	if (!ret)
		rdev->crit_proto_nlportid = info->snd_portid;

	return ret;
}

static int nl80211_crit_protocol_stop(struct sk_buff *skb,
				      struct genl_info *info)
{
	struct cfg80211_registered_device *rdev = info->user_ptr[0];
	struct wireless_dev *wdev = info->user_ptr[1];

	if (!rdev->ops->crit_proto_stop)
		return -EOPNOTSUPP;

	if (rdev->crit_proto_nlportid) {
		rdev->crit_proto_nlportid = 0;
		rdev_crit_proto_stop(rdev, wdev);
	}
	return 0;
}

8794 8795 8796
#define NL80211_FLAG_NEED_WIPHY		0x01
#define NL80211_FLAG_NEED_NETDEV	0x02
#define NL80211_FLAG_NEED_RTNL		0x04
8797 8798 8799
#define NL80211_FLAG_CHECK_NETDEV_UP	0x08
#define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
					 NL80211_FLAG_CHECK_NETDEV_UP)
8800
#define NL80211_FLAG_NEED_WDEV		0x10
8801
/* If a netdev is associated, it must be UP, P2P must be started */
8802 8803
#define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
					 NL80211_FLAG_CHECK_NETDEV_UP)
8804 8805 8806 8807 8808

static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
			    struct genl_info *info)
{
	struct cfg80211_registered_device *rdev;
8809
	struct wireless_dev *wdev;
8810 8811 8812 8813 8814 8815 8816
	struct net_device *dev;
	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;

	if (rtnl)
		rtnl_lock();

	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
J
Johannes Berg 已提交
8817
		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8818 8819 8820 8821 8822 8823
		if (IS_ERR(rdev)) {
			if (rtnl)
				rtnl_unlock();
			return PTR_ERR(rdev);
		}
		info->user_ptr[0] = rdev;
8824 8825
	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8826 8827
		ASSERT_RTNL();

8828 8829 8830
		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
						  info->attrs);
		if (IS_ERR(wdev)) {
8831 8832
			if (rtnl)
				rtnl_unlock();
8833
			return PTR_ERR(wdev);
8834
		}
8835 8836 8837 8838

		dev = wdev->netdev;
		rdev = wiphy_to_dev(wdev->wiphy);

8839 8840 8841 8842 8843 8844 8845 8846 8847 8848
		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
			if (!dev) {
				if (rtnl)
					rtnl_unlock();
				return -EINVAL;
			}

			info->user_ptr[1] = dev;
		} else {
			info->user_ptr[1] = wdev;
8849
		}
8850 8851 8852 8853 8854 8855 8856 8857 8858 8859

		if (dev) {
			if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
			    !netif_running(dev)) {
				if (rtnl)
					rtnl_unlock();
				return -ENETDOWN;
			}

			dev_hold(dev);
8860 8861 8862 8863 8864 8865
		} else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
			if (!wdev->p2p_started) {
				if (rtnl)
					rtnl_unlock();
				return -ENETDOWN;
			}
8866
		}
8867

8868 8869 8870 8871 8872 8873 8874 8875 8876
		info->user_ptr[0] = rdev;
	}

	return 0;
}

static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
			      struct genl_info *info)
{
8877 8878 8879 8880 8881 8882 8883 8884 8885 8886
	if (info->user_ptr[1]) {
		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
			struct wireless_dev *wdev = info->user_ptr[1];

			if (wdev->netdev)
				dev_put(wdev->netdev);
		} else {
			dev_put(info->user_ptr[1]);
		}
	}
8887 8888 8889 8890
	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
		rtnl_unlock();
}

8891 8892 8893 8894 8895
static struct genl_ops nl80211_ops[] = {
	{
		.cmd = NL80211_CMD_GET_WIPHY,
		.doit = nl80211_get_wiphy,
		.dumpit = nl80211_dump_wiphy,
8896
		.done = nl80211_dump_wiphy_done,
8897 8898
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
8899 8900
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
8901 8902 8903 8904 8905 8906
	},
	{
		.cmd = NL80211_CMD_SET_WIPHY,
		.doit = nl80211_set_wiphy,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8907
		.internal_flags = NL80211_FLAG_NEED_RTNL,
8908 8909 8910 8911 8912 8913 8914
	},
	{
		.cmd = NL80211_CMD_GET_INTERFACE,
		.doit = nl80211_get_interface,
		.dumpit = nl80211_dump_interface,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
8915 8916
		.internal_flags = NL80211_FLAG_NEED_WDEV |
				  NL80211_FLAG_NEED_RTNL,
8917 8918 8919 8920 8921 8922
	},
	{
		.cmd = NL80211_CMD_SET_INTERFACE,
		.doit = nl80211_set_interface,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8923 8924
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
8925 8926 8927 8928 8929 8930
	},
	{
		.cmd = NL80211_CMD_NEW_INTERFACE,
		.doit = nl80211_new_interface,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8931 8932
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
8933 8934 8935 8936 8937
	},
	{
		.cmd = NL80211_CMD_DEL_INTERFACE,
		.doit = nl80211_del_interface,
		.policy = nl80211_policy,
8938
		.flags = GENL_ADMIN_PERM,
8939
		.internal_flags = NL80211_FLAG_NEED_WDEV |
8940
				  NL80211_FLAG_NEED_RTNL,
8941 8942 8943 8944 8945 8946
	},
	{
		.cmd = NL80211_CMD_GET_KEY,
		.doit = nl80211_get_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8947
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8948
				  NL80211_FLAG_NEED_RTNL,
8949 8950 8951 8952 8953 8954
	},
	{
		.cmd = NL80211_CMD_SET_KEY,
		.doit = nl80211_set_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8955
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8956
				  NL80211_FLAG_NEED_RTNL,
8957 8958 8959 8960 8961 8962
	},
	{
		.cmd = NL80211_CMD_NEW_KEY,
		.doit = nl80211_new_key,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8963
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8964
				  NL80211_FLAG_NEED_RTNL,
8965 8966 8967 8968 8969
	},
	{
		.cmd = NL80211_CMD_DEL_KEY,
		.doit = nl80211_del_key,
		.policy = nl80211_policy,
8970
		.flags = GENL_ADMIN_PERM,
8971
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8972
				  NL80211_FLAG_NEED_RTNL,
8973
	},
8974 8975 8976 8977
	{
		.cmd = NL80211_CMD_SET_BEACON,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8978
		.doit = nl80211_set_beacon,
8979
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8980
				  NL80211_FLAG_NEED_RTNL,
8981 8982
	},
	{
8983
		.cmd = NL80211_CMD_START_AP,
8984 8985
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8986
		.doit = nl80211_start_ap,
8987
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8988
				  NL80211_FLAG_NEED_RTNL,
8989 8990
	},
	{
8991
		.cmd = NL80211_CMD_STOP_AP,
8992 8993
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
8994
		.doit = nl80211_stop_ap,
8995
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8996
				  NL80211_FLAG_NEED_RTNL,
8997
	},
8998 8999 9000
	{
		.cmd = NL80211_CMD_GET_STATION,
		.doit = nl80211_get_station,
9001
		.dumpit = nl80211_dump_station,
9002
		.policy = nl80211_policy,
9003 9004
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9005 9006 9007 9008 9009 9010
	},
	{
		.cmd = NL80211_CMD_SET_STATION,
		.doit = nl80211_set_station,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9011
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9012
				  NL80211_FLAG_NEED_RTNL,
9013 9014 9015 9016 9017 9018
	},
	{
		.cmd = NL80211_CMD_NEW_STATION,
		.doit = nl80211_new_station,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9019
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9020
				  NL80211_FLAG_NEED_RTNL,
9021 9022 9023 9024 9025
	},
	{
		.cmd = NL80211_CMD_DEL_STATION,
		.doit = nl80211_del_station,
		.policy = nl80211_policy,
9026
		.flags = GENL_ADMIN_PERM,
9027
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9028
				  NL80211_FLAG_NEED_RTNL,
9029 9030 9031 9032 9033 9034 9035
	},
	{
		.cmd = NL80211_CMD_GET_MPATH,
		.doit = nl80211_get_mpath,
		.dumpit = nl80211_dump_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9036
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9037
				  NL80211_FLAG_NEED_RTNL,
9038 9039 9040 9041 9042 9043
	},
	{
		.cmd = NL80211_CMD_SET_MPATH,
		.doit = nl80211_set_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9044
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9045
				  NL80211_FLAG_NEED_RTNL,
9046 9047 9048 9049 9050 9051
	},
	{
		.cmd = NL80211_CMD_NEW_MPATH,
		.doit = nl80211_new_mpath,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9052
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9053
				  NL80211_FLAG_NEED_RTNL,
9054 9055 9056 9057 9058
	},
	{
		.cmd = NL80211_CMD_DEL_MPATH,
		.doit = nl80211_del_mpath,
		.policy = nl80211_policy,
9059
		.flags = GENL_ADMIN_PERM,
9060
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9061
				  NL80211_FLAG_NEED_RTNL,
9062 9063 9064 9065 9066
	},
	{
		.cmd = NL80211_CMD_SET_BSS,
		.doit = nl80211_set_bss,
		.policy = nl80211_policy,
9067
		.flags = GENL_ADMIN_PERM,
9068
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9069
				  NL80211_FLAG_NEED_RTNL,
9070
	},
9071 9072 9073 9074
	{
		.cmd = NL80211_CMD_GET_REG,
		.doit = nl80211_get_reg,
		.policy = nl80211_policy,
9075
		.internal_flags = NL80211_FLAG_NEED_RTNL,
9076 9077
		/* can be retrieved by unprivileged users */
	},
9078 9079 9080 9081 9082
	{
		.cmd = NL80211_CMD_SET_REG,
		.doit = nl80211_set_reg,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9083
		.internal_flags = NL80211_FLAG_NEED_RTNL,
9084 9085 9086 9087 9088
	},
	{
		.cmd = NL80211_CMD_REQ_SET_REG,
		.doit = nl80211_req_set_reg,
		.policy = nl80211_policy,
9089 9090 9091
		.flags = GENL_ADMIN_PERM,
	},
	{
9092 9093
		.cmd = NL80211_CMD_GET_MESH_CONFIG,
		.doit = nl80211_get_mesh_config,
9094 9095
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
9096
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9097
				  NL80211_FLAG_NEED_RTNL,
9098 9099
	},
	{
9100 9101
		.cmd = NL80211_CMD_SET_MESH_CONFIG,
		.doit = nl80211_update_mesh_config,
9102
		.policy = nl80211_policy,
9103
		.flags = GENL_ADMIN_PERM,
9104
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9105
				  NL80211_FLAG_NEED_RTNL,
9106
	},
9107 9108 9109 9110 9111
	{
		.cmd = NL80211_CMD_TRIGGER_SCAN,
		.doit = nl80211_trigger_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
J
Johannes Berg 已提交
9112
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9113
				  NL80211_FLAG_NEED_RTNL,
9114 9115 9116 9117 9118 9119
	},
	{
		.cmd = NL80211_CMD_GET_SCAN,
		.policy = nl80211_policy,
		.dumpit = nl80211_dump_scan,
	},
9120 9121 9122 9123 9124 9125 9126 9127 9128 9129 9130 9131 9132 9133 9134 9135
	{
		.cmd = NL80211_CMD_START_SCHED_SCAN,
		.doit = nl80211_start_sched_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
		.doit = nl80211_stop_sched_scan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9136 9137 9138 9139 9140
	{
		.cmd = NL80211_CMD_AUTHENTICATE,
		.doit = nl80211_authenticate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9141
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9142
				  NL80211_FLAG_NEED_RTNL,
9143 9144 9145 9146 9147 9148
	},
	{
		.cmd = NL80211_CMD_ASSOCIATE,
		.doit = nl80211_associate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9149
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9150
				  NL80211_FLAG_NEED_RTNL,
9151 9152 9153 9154 9155 9156
	},
	{
		.cmd = NL80211_CMD_DEAUTHENTICATE,
		.doit = nl80211_deauthenticate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9157
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9158
				  NL80211_FLAG_NEED_RTNL,
9159 9160 9161 9162 9163 9164
	},
	{
		.cmd = NL80211_CMD_DISASSOCIATE,
		.doit = nl80211_disassociate,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9165
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9166
				  NL80211_FLAG_NEED_RTNL,
9167
	},
J
Johannes Berg 已提交
9168 9169 9170 9171 9172
	{
		.cmd = NL80211_CMD_JOIN_IBSS,
		.doit = nl80211_join_ibss,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9173
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9174
				  NL80211_FLAG_NEED_RTNL,
J
Johannes Berg 已提交
9175 9176 9177 9178 9179 9180
	},
	{
		.cmd = NL80211_CMD_LEAVE_IBSS,
		.doit = nl80211_leave_ibss,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9181
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9182
				  NL80211_FLAG_NEED_RTNL,
J
Johannes Berg 已提交
9183
	},
9184 9185 9186 9187
#ifdef CONFIG_NL80211_TESTMODE
	{
		.cmd = NL80211_CMD_TESTMODE,
		.doit = nl80211_testmode_do,
W
Wey-Yi Guy 已提交
9188
		.dumpit = nl80211_testmode_dump,
9189 9190
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9191 9192
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9193 9194
	},
#endif
S
Samuel Ortiz 已提交
9195 9196 9197 9198 9199
	{
		.cmd = NL80211_CMD_CONNECT,
		.doit = nl80211_connect,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9200
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9201
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9202 9203 9204 9205 9206 9207
	},
	{
		.cmd = NL80211_CMD_DISCONNECT,
		.doit = nl80211_disconnect,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9208
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9209
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9210
	},
9211 9212 9213 9214 9215
	{
		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
		.doit = nl80211_wiphy_netns,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9216 9217
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9218
	},
9219 9220 9221 9222 9223
	{
		.cmd = NL80211_CMD_GET_SURVEY,
		.policy = nl80211_policy,
		.dumpit = nl80211_dump_survey,
	},
S
Samuel Ortiz 已提交
9224 9225 9226 9227 9228
	{
		.cmd = NL80211_CMD_SET_PMKSA,
		.doit = nl80211_setdel_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9229
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9230
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9231 9232 9233 9234 9235 9236
	},
	{
		.cmd = NL80211_CMD_DEL_PMKSA,
		.doit = nl80211_setdel_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9237
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9238
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9239 9240 9241 9242 9243 9244
	},
	{
		.cmd = NL80211_CMD_FLUSH_PMKSA,
		.doit = nl80211_flush_pmksa,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9245
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9246
				  NL80211_FLAG_NEED_RTNL,
S
Samuel Ortiz 已提交
9247
	},
9248 9249 9250 9251 9252
	{
		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
		.doit = nl80211_remain_on_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9253
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9254
				  NL80211_FLAG_NEED_RTNL,
9255 9256 9257 9258 9259 9260
	},
	{
		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
		.doit = nl80211_cancel_remain_on_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9261
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9262
				  NL80211_FLAG_NEED_RTNL,
9263
	},
9264 9265 9266 9267 9268
	{
		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
		.doit = nl80211_set_tx_bitrate_mask,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9269 9270
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9271
	},
9272
	{
9273 9274
		.cmd = NL80211_CMD_REGISTER_FRAME,
		.doit = nl80211_register_mgmt,
9275 9276
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9277
		.internal_flags = NL80211_FLAG_NEED_WDEV |
9278
				  NL80211_FLAG_NEED_RTNL,
9279 9280
	},
	{
9281 9282
		.cmd = NL80211_CMD_FRAME,
		.doit = nl80211_tx_mgmt,
9283
		.policy = nl80211_policy,
9284
		.flags = GENL_ADMIN_PERM,
9285
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9286 9287 9288 9289 9290 9291
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
		.doit = nl80211_tx_mgmt_cancel_wait,
		.policy = nl80211_policy,
9292
		.flags = GENL_ADMIN_PERM,
9293
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9294
				  NL80211_FLAG_NEED_RTNL,
9295
	},
K
Kalle Valo 已提交
9296 9297 9298 9299 9300
	{
		.cmd = NL80211_CMD_SET_POWER_SAVE,
		.doit = nl80211_set_power_save,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9301 9302
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
K
Kalle Valo 已提交
9303 9304 9305 9306 9307 9308
	},
	{
		.cmd = NL80211_CMD_GET_POWER_SAVE,
		.doit = nl80211_get_power_save,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
9309 9310
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
K
Kalle Valo 已提交
9311
	},
9312 9313 9314 9315 9316
	{
		.cmd = NL80211_CMD_SET_CQM,
		.doit = nl80211_set_cqm,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9317 9318
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9319
	},
9320 9321 9322 9323 9324
	{
		.cmd = NL80211_CMD_SET_CHANNEL,
		.doit = nl80211_set_channel,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9325 9326
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9327
	},
9328 9329 9330 9331 9332
	{
		.cmd = NL80211_CMD_SET_WDS_PEER,
		.doit = nl80211_set_wds_peer,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9333 9334
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
9335
	},
9336 9337 9338 9339 9340 9341 9342 9343 9344 9345 9346 9347 9348 9349 9350 9351
	{
		.cmd = NL80211_CMD_JOIN_MESH,
		.doit = nl80211_join_mesh,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_LEAVE_MESH,
		.doit = nl80211_leave_mesh,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9352
#ifdef CONFIG_PM
J
Johannes Berg 已提交
9353 9354 9355 9356 9357 9358 9359 9360 9361 9362 9363 9364 9365 9366 9367 9368
	{
		.cmd = NL80211_CMD_GET_WOWLAN,
		.doit = nl80211_get_wowlan,
		.policy = nl80211_policy,
		/* can be retrieved by unprivileged users */
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_WOWLAN,
		.doit = nl80211_set_wowlan,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
9369
#endif
9370 9371 9372 9373 9374 9375 9376 9377
	{
		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
		.doit = nl80211_set_rekey_data,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9378 9379 9380 9381 9382 9383 9384 9385 9386 9387 9388 9389 9390 9391 9392 9393
	{
		.cmd = NL80211_CMD_TDLS_MGMT,
		.doit = nl80211_tdls_mgmt,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_TDLS_OPER,
		.doit = nl80211_tdls_oper,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9394 9395 9396 9397 9398 9399 9400 9401
	{
		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
		.doit = nl80211_register_unexpected_frame,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
J
Johannes Berg 已提交
9402 9403 9404 9405 9406
	{
		.cmd = NL80211_CMD_PROBE_CLIENT,
		.doit = nl80211_probe_client,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
9407
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
J
Johannes Berg 已提交
9408 9409
				  NL80211_FLAG_NEED_RTNL,
	},
9410 9411 9412 9413 9414 9415 9416 9417
	{
		.cmd = NL80211_CMD_REGISTER_BEACONS,
		.doit = nl80211_register_beacons,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
9418 9419 9420 9421 9422 9423 9424 9425
	{
		.cmd = NL80211_CMD_SET_NOACK_MAP,
		.doit = nl80211_set_noack_map,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
9426 9427 9428 9429 9430 9431 9432 9433 9434 9435 9436 9437 9438 9439 9440 9441
	{
		.cmd = NL80211_CMD_START_P2P_DEVICE,
		.doit = nl80211_start_p2p_device,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
		.doit = nl80211_stop_p2p_device,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9442 9443 9444
	{
		.cmd = NL80211_CMD_SET_MCAST_RATE,
		.doit = nl80211_set_mcast_rate,
9445 9446 9447 9448 9449 9450 9451 9452
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_MAC_ACL,
		.doit = nl80211_set_mac_acl,
9453 9454 9455 9456 9457
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV |
				  NL80211_FLAG_NEED_RTNL,
	},
9458 9459 9460 9461 9462 9463 9464 9465
	{
		.cmd = NL80211_CMD_RADAR_DETECT,
		.doit = nl80211_start_radar_detection,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9466 9467 9468 9469 9470
	{
		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
		.doit = nl80211_get_protocol_features,
		.policy = nl80211_policy,
	},
9471 9472 9473 9474 9475 9476 9477 9478
	{
		.cmd = NL80211_CMD_UPDATE_FT_IES,
		.doit = nl80211_update_ft_ies,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9479 9480 9481 9482 9483 9484 9485 9486 9487 9488 9489 9490 9491 9492 9493
	{
		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
		.doit = nl80211_crit_protocol_start,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
		.doit = nl80211_crit_protocol_stop,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
9494 9495 9496 9497 9498 9499 9500 9501 9502 9503 9504 9505 9506 9507 9508
	},
	{
		.cmd = NL80211_CMD_GET_COALESCE,
		.doit = nl80211_get_coalesce,
		.policy = nl80211_policy,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
	},
	{
		.cmd = NL80211_CMD_SET_COALESCE,
		.doit = nl80211_set_coalesce,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_WIPHY |
				  NL80211_FLAG_NEED_RTNL,
9509 9510 9511 9512 9513 9514 9515 9516 9517
	},
	{
		.cmd = NL80211_CMD_CHANNEL_SWITCH,
		.doit = nl80211_channel_switch,
		.policy = nl80211_policy,
		.flags = GENL_ADMIN_PERM,
		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
				  NL80211_FLAG_NEED_RTNL,
	},
9518
};
9519

9520 9521 9522
static struct genl_multicast_group nl80211_mlme_mcgrp = {
	.name = "mlme",
};
9523 9524 9525 9526 9527

/* multicast groups */
static struct genl_multicast_group nl80211_config_mcgrp = {
	.name = "config",
};
9528 9529 9530
static struct genl_multicast_group nl80211_scan_mcgrp = {
	.name = "scan",
};
9531 9532 9533
static struct genl_multicast_group nl80211_regulatory_mcgrp = {
	.name = "regulatory",
};
9534 9535 9536 9537 9538 9539

/* notification functions */

void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
{
	struct sk_buff *msg;
9540
	struct nl80211_dump_wiphy_state state = {};
9541

9542
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9543 9544 9545
	if (!msg)
		return;

9546
	if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9547 9548 9549 9550
		nlmsg_free(msg);
		return;
	}

9551 9552
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_config_mcgrp.id, GFP_KERNEL);
9553 9554
}

9555 9556 9557 9558 9559 9560 9561 9562 9563 9564 9565 9566 9567
static int nl80211_add_scan_req(struct sk_buff *msg,
				struct cfg80211_registered_device *rdev)
{
	struct cfg80211_scan_request *req = rdev->scan_req;
	struct nlattr *nest;
	int i;

	if (WARN_ON(!req))
		return 0;

	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
	if (!nest)
		goto nla_put_failure;
9568 9569 9570 9571
	for (i = 0; i < req->n_ssids; i++) {
		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
			goto nla_put_failure;
	}
9572 9573 9574 9575 9576
	nla_nest_end(msg, nest);

	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
	if (!nest)
		goto nla_put_failure;
9577 9578 9579 9580
	for (i = 0; i < req->n_channels; i++) {
		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
			goto nla_put_failure;
	}
9581 9582
	nla_nest_end(msg, nest);

9583 9584 9585
	if (req->ie &&
	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
		goto nla_put_failure;
9586

9587 9588 9589
	if (req->flags)
		nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);

9590 9591 9592 9593 9594
	return 0;
 nla_put_failure:
	return -ENOBUFS;
}

9595 9596
static int nl80211_send_scan_msg(struct sk_buff *msg,
				 struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9597
				 struct wireless_dev *wdev,
9598
				 u32 portid, u32 seq, int flags,
9599
				 u32 cmd)
9600 9601 9602
{
	void *hdr;

9603
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9604 9605 9606
	if (!hdr)
		return -1;

9607
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
J
Johannes Berg 已提交
9608 9609 9610
	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					 wdev->netdev->ifindex)) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9611
		goto nla_put_failure;
9612

9613 9614
	/* ignore errors and send incomplete event anyway */
	nl80211_add_scan_req(msg, rdev);
9615 9616 9617 9618 9619 9620 9621 9622

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

9623 9624 9625 9626
static int
nl80211_send_sched_scan_msg(struct sk_buff *msg,
			    struct cfg80211_registered_device *rdev,
			    struct net_device *netdev,
9627
			    u32 portid, u32 seq, int flags, u32 cmd)
9628 9629 9630
{
	void *hdr;

9631
	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9632 9633 9634
	if (!hdr)
		return -1;

9635 9636 9637
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;
9638 9639 9640 9641 9642 9643 9644 9645

	return genlmsg_end(msg, hdr);

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	return -EMSGSIZE;
}

9646
void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9647
			     struct wireless_dev *wdev)
9648 9649 9650
{
	struct sk_buff *msg;

9651
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9652 9653 9654
	if (!msg)
		return;

J
Johannes Berg 已提交
9655
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9656 9657 9658 9659 9660
				  NL80211_CMD_TRIGGER_SCAN) < 0) {
		nlmsg_free(msg);
		return;
	}

9661 9662
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
9663 9664
}

9665
void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9666
			    struct wireless_dev *wdev)
9667 9668 9669
{
	struct sk_buff *msg;

9670
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9671 9672 9673
	if (!msg)
		return;

J
Johannes Berg 已提交
9674
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9675
				  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9676 9677 9678 9679
		nlmsg_free(msg);
		return;
	}

9680 9681
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
9682 9683 9684
}

void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
J
Johannes Berg 已提交
9685
			       struct wireless_dev *wdev)
9686 9687 9688
{
	struct sk_buff *msg;

9689
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9690 9691 9692
	if (!msg)
		return;

J
Johannes Berg 已提交
9693
	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9694
				  NL80211_CMD_SCAN_ABORTED) < 0) {
9695 9696 9697 9698
		nlmsg_free(msg);
		return;
	}

9699 9700
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
9701 9702
}

9703 9704 9705 9706 9707 9708 9709 9710 9711 9712 9713 9714 9715 9716 9717 9718 9719 9720 9721 9722 9723 9724 9725 9726
void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev)
{
	struct sk_buff *msg;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
					NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
		nlmsg_free(msg);
		return;
	}

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
}

void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
			     struct net_device *netdev, u32 cmd)
{
	struct sk_buff *msg;

9727
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9728 9729 9730 9731 9732 9733 9734 9735 9736 9737 9738 9739
	if (!msg)
		return;

	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
		nlmsg_free(msg);
		return;
	}

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_scan_mcgrp.id, GFP_KERNEL);
}

9740 9741 9742 9743 9744 9745 9746 9747 9748
/*
 * This can happen on global regulatory changes or device specific settings
 * based on custom world regulatory domains.
 */
void nl80211_send_reg_change_event(struct regulatory_request *request)
{
	struct sk_buff *msg;
	void *hdr;

9749
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9750 9751 9752 9753 9754 9755 9756 9757 9758 9759
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	/* Userspace can always count this one always being set */
9760 9761 9762 9763 9764 9765 9766 9767 9768 9769 9770 9771 9772 9773 9774 9775 9776 9777 9778 9779 9780 9781 9782 9783
	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
		goto nla_put_failure;

	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_WORLD))
			goto nla_put_failure;
	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
			goto nla_put_failure;
	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
		   request->intersect) {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_INTERSECTION))
			goto nla_put_failure;
	} else {
		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
			       NL80211_REGDOM_TYPE_COUNTRY) ||
		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
				   request->alpha2))
			goto nla_put_failure;
	}

J
Johannes Berg 已提交
9784
	if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9785 9786
	    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
		goto nla_put_failure;
9787

J
Johannes Berg 已提交
9788
	genlmsg_end(msg, hdr);
9789

9790
	rcu_read_lock();
9791
	genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9792 9793
				GFP_ATOMIC);
	rcu_read_unlock();
9794 9795 9796 9797 9798 9799 9800 9801

	return;

nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

9802 9803 9804
static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
				    struct net_device *netdev,
				    const u8 *buf, size_t len,
9805
				    enum nl80211_commands cmd, gfp_t gfp)
9806 9807 9808 9809
{
	struct sk_buff *msg;
	void *hdr;

9810
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9811 9812 9813 9814 9815 9816 9817 9818 9819
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

9820 9821 9822 9823
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
		goto nla_put_failure;
9824

J
Johannes Berg 已提交
9825
	genlmsg_end(msg, hdr);
9826

9827 9828
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
9829 9830 9831 9832 9833 9834 9835 9836
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9837 9838
			  struct net_device *netdev, const u8 *buf,
			  size_t len, gfp_t gfp)
9839 9840
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
9841
				NL80211_CMD_AUTHENTICATE, gfp);
9842 9843 9844 9845
}

void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
			   struct net_device *netdev, const u8 *buf,
9846
			   size_t len, gfp_t gfp)
9847
{
9848 9849
	nl80211_send_mlme_event(rdev, netdev, buf, len,
				NL80211_CMD_ASSOCIATE, gfp);
9850 9851
}

9852
void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9853 9854
			 struct net_device *netdev, const u8 *buf,
			 size_t len, gfp_t gfp)
9855 9856
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
9857
				NL80211_CMD_DEAUTHENTICATE, gfp);
9858 9859
}

9860 9861
void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
			   struct net_device *netdev, const u8 *buf,
9862
			   size_t len, gfp_t gfp)
9863 9864
{
	nl80211_send_mlme_event(rdev, netdev, buf, len,
9865
				NL80211_CMD_DISASSOCIATE, gfp);
9866 9867
}

9868 9869
void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
				  size_t len)
9870
{
9871 9872 9873
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9874 9875
	const struct ieee80211_mgmt *mgmt = (void *)buf;
	u32 cmd;
9876

9877 9878
	if (WARN_ON(len < 2))
		return;
9879

9880 9881 9882 9883
	if (ieee80211_is_deauth(mgmt->frame_control))
		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
	else
		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9884

9885 9886
	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9887
}
9888
EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9889

9890 9891
static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
				      struct net_device *netdev, int cmd,
9892
				      const u8 *addr, gfp_t gfp)
9893 9894 9895 9896
{
	struct sk_buff *msg;
	void *hdr;

9897
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9898 9899 9900 9901 9902 9903 9904 9905 9906
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

9907 9908 9909 9910 9911
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
		goto nla_put_failure;
9912

J
Johannes Berg 已提交
9913
	genlmsg_end(msg, hdr);
9914

9915 9916
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
9917 9918 9919 9920 9921 9922 9923 9924
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9925 9926
			       struct net_device *netdev, const u8 *addr,
			       gfp_t gfp)
9927 9928
{
	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9929
				  addr, gfp);
9930 9931 9932
}

void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9933 9934
				struct net_device *netdev, const u8 *addr,
				gfp_t gfp)
9935
{
9936 9937
	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
				  addr, gfp);
9938 9939
}

S
Samuel Ortiz 已提交
9940 9941 9942 9943 9944 9945 9946 9947 9948
void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
				 struct net_device *netdev, const u8 *bssid,
				 const u8 *req_ie, size_t req_ie_len,
				 const u8 *resp_ie, size_t resp_ie_len,
				 u16 status, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

9949
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
S
Samuel Ortiz 已提交
9950 9951 9952 9953 9954 9955 9956 9957 9958
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

9959 9960 9961 9962 9963 9964 9965 9966 9967
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
	    (req_ie &&
	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
	    (resp_ie &&
	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
		goto nla_put_failure;
S
Samuel Ortiz 已提交
9968

J
Johannes Berg 已提交
9969
	genlmsg_end(msg, hdr);
S
Samuel Ortiz 已提交
9970

9971 9972
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
S
Samuel Ortiz 已提交
9973 9974 9975 9976 9977 9978 9979 9980 9981 9982 9983 9984 9985 9986 9987 9988
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
			 struct net_device *netdev, const u8 *bssid,
			 const u8 *req_ie, size_t req_ie_len,
			 const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

9989
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
S
Samuel Ortiz 已提交
9990 9991 9992 9993 9994 9995 9996 9997 9998
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

9999 10000 10001 10002 10003 10004 10005 10006
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
	    (req_ie &&
	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
	    (resp_ie &&
	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
		goto nla_put_failure;
S
Samuel Ortiz 已提交
10007

J
Johannes Berg 已提交
10008
	genlmsg_end(msg, hdr);
S
Samuel Ortiz 已提交
10009

10010 10011
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
S
Samuel Ortiz 已提交
10012 10013 10014 10015 10016 10017 10018 10019 10020 10021
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
			       struct net_device *netdev, u16 reason,
J
Johannes Berg 已提交
10022
			       const u8 *ie, size_t ie_len, bool from_ap)
S
Samuel Ortiz 已提交
10023 10024 10025 10026
{
	struct sk_buff *msg;
	void *hdr;

10027
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
S
Samuel Ortiz 已提交
10028 10029 10030 10031 10032 10033 10034 10035 10036
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10037 10038 10039 10040 10041 10042 10043 10044
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (from_ap && reason &&
	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
	    (from_ap &&
	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
		goto nla_put_failure;
S
Samuel Ortiz 已提交
10045

J
Johannes Berg 已提交
10046
	genlmsg_end(msg, hdr);
S
Samuel Ortiz 已提交
10047

10048 10049
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, GFP_KERNEL);
S
Samuel Ortiz 已提交
10050 10051 10052 10053 10054 10055 10056 10057
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}

J
Johannes Berg 已提交
10058 10059 10060 10061 10062 10063 10064
void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
			     struct net_device *netdev, const u8 *bssid,
			     gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

10065
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
J
Johannes Berg 已提交
10066 10067 10068 10069 10070 10071 10072 10073 10074
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10075 10076 10077 10078
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
		goto nla_put_failure;
J
Johannes Berg 已提交
10079

J
Johannes Berg 已提交
10080
	genlmsg_end(msg, hdr);
J
Johannes Berg 已提交
10081

10082 10083
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
J
Johannes Berg 已提交
10084 10085 10086 10087 10088 10089 10090
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10091 10092
void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
					const u8* ie, u8 ie_len, gfp_t gfp)
10093
{
10094 10095
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10096 10097 10098
	struct sk_buff *msg;
	void *hdr;

10099 10100 10101 10102 10103
	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
		return;

	trace_cfg80211_notify_new_peer_candidate(dev, addr);

10104 10105 10106 10107 10108 10109 10110 10111 10112 10113
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10114
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10115 10116
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10117 10118 10119
	    (ie_len && ie &&
	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
		goto nla_put_failure;
10120

J
Johannes Berg 已提交
10121
	genlmsg_end(msg, hdr);
10122 10123 10124 10125 10126 10127 10128 10129 10130

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10131
EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10132

10133 10134 10135
void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
				 struct net_device *netdev, const u8 *addr,
				 enum nl80211_key_type key_type, int key_id,
10136
				 const u8 *tsc, gfp_t gfp)
10137 10138 10139 10140
{
	struct sk_buff *msg;
	void *hdr;

10141
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10142 10143 10144 10145 10146 10147 10148 10149 10150
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10151 10152 10153 10154 10155 10156 10157 10158
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
	    (key_id != -1 &&
	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
		goto nla_put_failure;
10159

J
Johannes Berg 已提交
10160
	genlmsg_end(msg, hdr);
10161

10162 10163
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
10164 10165 10166 10167 10168 10169 10170
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10171 10172 10173 10174 10175 10176 10177 10178
void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
				    struct ieee80211_channel *channel_before,
				    struct ieee80211_channel *channel_after)
{
	struct sk_buff *msg;
	void *hdr;
	struct nlattr *nl_freq;

10179
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10180 10181 10182 10183 10184 10185 10186 10187 10188 10189 10190 10191 10192
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	/*
	 * Since we are applying the beacon hint to a wiphy we know its
	 * wiphy_idx is valid
	 */
10193 10194
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
		goto nla_put_failure;
10195 10196 10197 10198 10199

	/* Before */
	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
	if (!nl_freq)
		goto nla_put_failure;
10200
	if (nl80211_msg_put_channel(msg, channel_before, false))
10201 10202 10203 10204 10205 10206 10207
		goto nla_put_failure;
	nla_nest_end(msg, nl_freq);

	/* After */
	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
	if (!nl_freq)
		goto nla_put_failure;
10208
	if (nl80211_msg_put_channel(msg, channel_after, false))
10209 10210 10211
		goto nla_put_failure;
	nla_nest_end(msg, nl_freq);

J
Johannes Berg 已提交
10212
	genlmsg_end(msg, hdr);
10213

10214 10215 10216 10217
	rcu_read_lock();
	genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
				GFP_ATOMIC);
	rcu_read_unlock();
10218 10219 10220 10221 10222 10223 10224 10225

	return;

nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10226 10227
static void nl80211_send_remain_on_chan_event(
	int cmd, struct cfg80211_registered_device *rdev,
10228
	struct wireless_dev *wdev, u64 cookie,
10229 10230 10231 10232 10233 10234 10235 10236 10237 10238 10239 10240 10241 10242 10243 10244
	struct ieee80211_channel *chan,
	unsigned int duration, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10245
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10246 10247
	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					 wdev->netdev->ifindex)) ||
10248
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10249
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10250 10251
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
			NL80211_CHAN_NO_HT) ||
10252 10253
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
		goto nla_put_failure;
10254

10255 10256 10257
	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
		goto nla_put_failure;
10258

J
Johannes Berg 已提交
10259
	genlmsg_end(msg, hdr);
10260 10261 10262 10263 10264 10265 10266 10267 10268 10269

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10270 10271 10272
void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
			       struct ieee80211_channel *chan,
			       unsigned int duration, gfp_t gfp)
10273
{
10274 10275 10276 10277
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10278
	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10279
					  rdev, wdev, cookie, chan,
10280
					  duration, gfp);
10281
}
10282
EXPORT_SYMBOL(cfg80211_ready_on_channel);
10283

10284 10285 10286
void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
					struct ieee80211_channel *chan,
					gfp_t gfp)
10287
{
10288 10289 10290 10291
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10292
	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10293
					  rdev, wdev, cookie, chan, 0, gfp);
10294
}
10295
EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10296

10297 10298
void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
		      struct station_info *sinfo, gfp_t gfp)
10299
{
10300 10301
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10302 10303
	struct sk_buff *msg;

10304 10305
	trace_cfg80211_new_sta(dev, mac_addr, sinfo);

10306
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10307 10308 10309
	if (!msg)
		return;

10310 10311
	if (nl80211_send_station(msg, 0, 0, 0,
				 rdev, dev, mac_addr, sinfo) < 0) {
10312 10313 10314 10315 10316 10317 10318
		nlmsg_free(msg);
		return;
	}

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
}
10319
EXPORT_SYMBOL(cfg80211_new_sta);
10320

10321
void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10322
{
10323 10324
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10325 10326 10327
	struct sk_buff *msg;
	void *hdr;

10328 10329
	trace_cfg80211_del_sta(dev, mac_addr);

10330
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10331 10332 10333 10334 10335 10336 10337 10338 10339
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10340 10341 10342
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
		goto nla_put_failure;
10343

J
Johannes Berg 已提交
10344
	genlmsg_end(msg, hdr);
10345 10346 10347 10348 10349 10350 10351 10352 10353

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10354
EXPORT_SYMBOL(cfg80211_del_sta);
10355

10356 10357 10358
void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
			  enum nl80211_connect_failed_reason reason,
			  gfp_t gfp)
10359
{
10360 10361
	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10362 10363 10364 10365 10366 10367 10368 10369 10370 10371 10372 10373 10374 10375 10376 10377 10378 10379 10380 10381 10382 10383 10384 10385 10386 10387 10388 10389
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10390
EXPORT_SYMBOL(cfg80211_conn_failed);
10391

10392 10393
static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
				       const u8 *addr, gfp_t gfp)
10394 10395 10396 10397 10398
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;
10399
	u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10400

10401
	if (!nlportid)
10402 10403 10404 10405 10406 10407
		return false;

	msg = nlmsg_new(100, gfp);
	if (!msg)
		return true;

10408
	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10409 10410 10411 10412 10413
	if (!hdr) {
		nlmsg_free(msg);
		return true;
	}

10414 10415 10416 10417
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
		goto nla_put_failure;
10418

10419
	genlmsg_end(msg, hdr);
10420
	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10421 10422 10423 10424 10425 10426 10427 10428
	return true;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
	return true;
}

10429 10430
bool cfg80211_rx_spurious_frame(struct net_device *dev,
				const u8 *addr, gfp_t gfp)
10431
{
10432 10433 10434 10435 10436 10437 10438 10439 10440 10441 10442 10443 10444 10445
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	bool ret;

	trace_cfg80211_rx_spurious_frame(dev, addr);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
		trace_cfg80211_return_bool(false);
		return false;
	}
	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
					 addr, gfp);
	trace_cfg80211_return_bool(ret);
	return ret;
10446
}
10447
EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10448

10449 10450
bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
					const u8 *addr, gfp_t gfp)
10451
{
10452 10453 10454 10455 10456 10457 10458 10459 10460 10461 10462 10463 10464 10465 10466 10467
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	bool ret;

	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
		trace_cfg80211_return_bool(false);
		return false;
	}
	ret = __nl80211_unexpected_frame(dev,
					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
					 addr, gfp);
	trace_cfg80211_return_bool(ret);
	return ret;
10468
}
10469
EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10470

10471
int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10472
		      struct wireless_dev *wdev, u32 nlportid,
10473
		      int freq, int sig_dbm,
10474
		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10475
{
10476
	struct net_device *netdev = wdev->netdev;
10477 10478 10479 10480 10481 10482 10483
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return -ENOMEM;

10484
	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10485 10486 10487 10488 10489
	if (!hdr) {
		nlmsg_free(msg);
		return -ENOMEM;
	}

10490
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10491 10492
	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					netdev->ifindex)) ||
10493
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10494 10495 10496
	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
	    (sig_dbm &&
	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10497 10498 10499
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
	    (flags &&
	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10500
		goto nla_put_failure;
10501

J
Johannes Berg 已提交
10502
	genlmsg_end(msg, hdr);
10503

10504
	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10505 10506 10507 10508 10509 10510 10511

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
	return -ENOBUFS;
}

10512 10513
void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
10514
{
10515 10516
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10517
	struct net_device *netdev = wdev->netdev;
10518 10519 10520
	struct sk_buff *msg;
	void *hdr;

10521 10522
	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);

10523 10524 10525 10526
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

10527
	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10528 10529 10530 10531 10532
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10533
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10534 10535
	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
				   netdev->ifindex)) ||
10536
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10537 10538 10539 10540
	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
		goto nla_put_failure;
10541

J
Johannes Berg 已提交
10542
	genlmsg_end(msg, hdr);
10543

10544 10545
	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
10546 10547 10548 10549 10550 10551
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10552
EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10553

10554 10555 10556
void cfg80211_cqm_rssi_notify(struct net_device *dev,
			      enum nl80211_cqm_rssi_threshold_event rssi_event,
			      gfp_t gfp)
10557
{
10558 10559 10560
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10561 10562 10563 10564
	struct sk_buff *msg;
	struct nlattr *pinfoattr;
	void *hdr;

10565 10566
	trace_cfg80211_cqm_rssi_notify(dev, rssi_event);

10567
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10568 10569 10570 10571 10572 10573 10574 10575 10576
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10577
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10578
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10579
		goto nla_put_failure;
10580 10581 10582 10583 10584

	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!pinfoattr)
		goto nla_put_failure;

10585 10586 10587
	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
			rssi_event))
		goto nla_put_failure;
10588 10589 10590

	nla_nest_end(msg, pinfoattr);

J
Johannes Berg 已提交
10591
	genlmsg_end(msg, hdr);
10592 10593 10594 10595 10596 10597 10598 10599 10600

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10601
EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10602

10603 10604 10605
static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev, const u8 *bssid,
				     const u8 *replay_ctr, gfp_t gfp)
10606 10607 10608 10609 10610
{
	struct sk_buff *msg;
	struct nlattr *rekey_attr;
	void *hdr;

10611
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10612 10613 10614 10615 10616 10617 10618 10619 10620
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10621 10622 10623 10624
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
		goto nla_put_failure;
10625 10626 10627 10628 10629

	rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
	if (!rekey_attr)
		goto nla_put_failure;

10630 10631 10632
	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
		    NL80211_REPLAY_CTR_LEN, replay_ctr))
		goto nla_put_failure;
10633 10634 10635

	nla_nest_end(msg, rekey_attr);

J
Johannes Berg 已提交
10636
	genlmsg_end(msg, hdr);
10637 10638 10639 10640 10641 10642 10643 10644 10645 10646

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10647 10648 10649 10650 10651 10652 10653 10654 10655 10656 10657 10658 10659 10660 10661 10662
void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
			       const u8 *replay_ctr, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_gtk_rekey_notify(dev, bssid);
	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
}
EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);

static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
			       struct net_device *netdev, int index,
			       const u8 *bssid, bool preauth, gfp_t gfp)
10663 10664 10665 10666 10667
{
	struct sk_buff *msg;
	struct nlattr *attr;
	void *hdr;

10668
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10669 10670 10671 10672 10673 10674 10675 10676 10677
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10678 10679 10680
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;
10681 10682 10683 10684 10685

	attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
	if (!attr)
		goto nla_put_failure;

10686 10687 10688 10689 10690
	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
	    (preauth &&
	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
		goto nla_put_failure;
10691 10692 10693

	nla_nest_end(msg, attr);

J
Johannes Berg 已提交
10694
	genlmsg_end(msg, hdr);
10695 10696 10697 10698 10699 10700 10701 10702 10703 10704

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10705 10706 10707 10708 10709 10710 10711 10712 10713 10714 10715 10716 10717 10718 10719 10720
void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
				     const u8 *bssid, bool preauth, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
}
EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);

static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
				     struct net_device *netdev,
				     struct cfg80211_chan_def *chandef,
				     gfp_t gfp)
10721 10722 10723 10724
{
	struct sk_buff *msg;
	void *hdr;

10725
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10726 10727 10728 10729 10730 10731 10732 10733 10734
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10735 10736 10737 10738
	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
		goto nla_put_failure;

	if (nl80211_send_chandef(msg, chandef))
10739
		goto nla_put_failure;
10740 10741 10742 10743 10744 10745 10746 10747 10748 10749 10750 10751

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10752 10753
void cfg80211_ch_switch_notify(struct net_device *dev,
			       struct cfg80211_chan_def *chandef)
10754
{
10755 10756 10757 10758 10759 10760 10761 10762 10763
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);

	trace_cfg80211_ch_switch_notify(dev, chandef);

	wdev_lock(wdev);

	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10764 10765
		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
		    wdev->iftype != NL80211_IFTYPE_ADHOC))
10766 10767 10768 10769 10770 10771 10772 10773 10774 10775 10776 10777 10778 10779 10780 10781 10782
		goto out;

	wdev->channel = chandef->chan;
	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
out:
	wdev_unlock(wdev);
	return;
}
EXPORT_SYMBOL(cfg80211_ch_switch_notify);

void cfg80211_cqm_txe_notify(struct net_device *dev,
			     const u8 *peer, u32 num_packets,
			     u32 rate, u32 intvl, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10783 10784 10785 10786 10787 10788 10789 10790 10791 10792 10793 10794 10795 10796 10797
	struct sk_buff *msg;
	struct nlattr *pinfoattr;
	void *hdr;

	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10798
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10799 10800 10801 10802 10803 10804 10805 10806 10807 10808 10809 10810 10811 10812 10813 10814 10815 10816 10817 10818 10819 10820 10821 10822 10823 10824 10825 10826
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
		goto nla_put_failure;

	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!pinfoattr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
		goto nla_put_failure;

	nla_nest_end(msg, pinfoattr);

	genlmsg_end(msg, hdr);

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10827
EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10828

10829 10830 10831 10832 10833 10834 10835 10836 10837 10838 10839 10840 10841 10842 10843 10844 10845 10846 10847 10848 10849 10850 10851 10852 10853 10854 10855 10856 10857 10858 10859 10860 10861 10862 10863 10864 10865
void
nl80211_radar_notify(struct cfg80211_registered_device *rdev,
		     struct cfg80211_chan_def *chandef,
		     enum nl80211_radar_event event,
		     struct net_device *netdev, gfp_t gfp)
{
	struct sk_buff *msg;
	void *hdr;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
		goto nla_put_failure;

	/* NOP and radar events don't need a netdev parameter */
	if (netdev) {
		struct wireless_dev *wdev = netdev->ieee80211_ptr;

		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
		    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
			goto nla_put_failure;
	}

	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
		goto nla_put_failure;

	if (nl80211_send_chandef(msg, chandef))
		goto nla_put_failure;

10866
	genlmsg_end(msg, hdr);
10867 10868 10869 10870 10871 10872 10873 10874 10875 10876

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}

10877 10878
void cfg80211_cqm_pktloss_notify(struct net_device *dev,
				 const u8 *peer, u32 num_packets, gfp_t gfp)
10879
{
10880 10881 10882
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct wiphy *wiphy = wdev->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10883 10884 10885 10886
	struct sk_buff *msg;
	struct nlattr *pinfoattr;
	void *hdr;

10887 10888
	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);

10889
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10890 10891 10892 10893 10894 10895 10896 10897 10898
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10899
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10900
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10901 10902
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
		goto nla_put_failure;
10903 10904 10905 10906 10907

	pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
	if (!pinfoattr)
		goto nla_put_failure;

10908 10909
	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
		goto nla_put_failure;
10910 10911 10912

	nla_nest_end(msg, pinfoattr);

J
Johannes Berg 已提交
10913
	genlmsg_end(msg, hdr);
10914 10915 10916 10917 10918 10919 10920 10921 10922

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
10923
EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10924

J
Johannes Berg 已提交
10925 10926 10927 10928 10929 10930 10931 10932
void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
			   u64 cookie, bool acked, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;

10933 10934
	trace_cfg80211_probe_status(dev, addr, cookie, acked);

10935
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10936

J
Johannes Berg 已提交
10937 10938 10939 10940 10941 10942 10943 10944 10945
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

10946 10947 10948 10949 10950 10951
	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
		goto nla_put_failure;
J
Johannes Berg 已提交
10952

10953
	genlmsg_end(msg, hdr);
J
Johannes Berg 已提交
10954 10955 10956 10957 10958 10959 10960 10961 10962 10963 10964

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_probe_status);

10965 10966
void cfg80211_report_obss_beacon(struct wiphy *wiphy,
				 const u8 *frame, size_t len,
10967
				 int freq, int sig_dbm)
10968 10969 10970 10971
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	struct sk_buff *msg;
	void *hdr;
10972
	struct cfg80211_beacon_registration *reg;
10973

10974 10975
	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);

10976 10977 10978 10979 10980 10981 10982
	spin_lock_bh(&rdev->beacon_registrations_lock);
	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
		msg = nlmsg_new(len + 100, GFP_ATOMIC);
		if (!msg) {
			spin_unlock_bh(&rdev->beacon_registrations_lock);
			return;
		}
10983

10984 10985 10986
		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
		if (!hdr)
			goto nla_put_failure;
10987

10988 10989 10990 10991 10992 10993 10994
		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
		    (freq &&
		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
		    (sig_dbm &&
		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
			goto nla_put_failure;
10995

10996
		genlmsg_end(msg, hdr);
10997

10998 10999 11000
		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
	}
	spin_unlock_bh(&rdev->beacon_registrations_lock);
11001 11002 11003
	return;

 nla_put_failure:
11004 11005 11006
	spin_unlock_bh(&rdev->beacon_registrations_lock);
	if (hdr)
		genlmsg_cancel(msg, hdr);
11007 11008 11009 11010
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_report_obss_beacon);

11011 11012 11013 11014 11015 11016 11017 11018
#ifdef CONFIG_PM
void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
				   struct cfg80211_wowlan_wakeup *wakeup,
				   gfp_t gfp)
{
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;
11019
	int size = 200;
11020 11021 11022 11023 11024 11025 11026 11027 11028 11029 11030 11031 11032 11033 11034 11035 11036 11037 11038 11039 11040 11041 11042 11043 11044 11045 11046 11047 11048 11049 11050 11051 11052 11053 11054 11055 11056 11057 11058 11059 11060 11061 11062 11063 11064 11065 11066 11067 11068 11069 11070

	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);

	if (wakeup)
		size += wakeup->packet_present_len;

	msg = nlmsg_new(size, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
	if (!hdr)
		goto free_msg;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto free_msg;

	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
					wdev->netdev->ifindex))
		goto free_msg;

	if (wakeup) {
		struct nlattr *reasons;

		reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);

		if (wakeup->disconnect &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
			goto free_msg;
		if (wakeup->magic_pkt &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
			goto free_msg;
		if (wakeup->gtk_rekey_failure &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
			goto free_msg;
		if (wakeup->eap_identity_req &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
			goto free_msg;
		if (wakeup->four_way_handshake &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
			goto free_msg;
		if (wakeup->rfkill_release &&
		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
			goto free_msg;

		if (wakeup->pattern_idx >= 0 &&
		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
				wakeup->pattern_idx))
			goto free_msg;

11071 11072 11073 11074 11075 11076 11077 11078 11079 11080 11081
		if (wakeup->tcp_match)
			nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);

		if (wakeup->tcp_connlost)
			nla_put_flag(msg,
				     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);

		if (wakeup->tcp_nomoretokens)
			nla_put_flag(msg,
				NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);

11082 11083 11084 11085 11086 11087 11088 11089 11090 11091 11092 11093 11094 11095 11096 11097 11098 11099 11100 11101 11102 11103 11104
		if (wakeup->packet) {
			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;

			if (!wakeup->packet_80211) {
				pkt_attr =
					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
				len_attr =
					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
			}

			if (wakeup->packet_len &&
			    nla_put_u32(msg, len_attr, wakeup->packet_len))
				goto free_msg;

			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
				    wakeup->packet))
				goto free_msg;
		}

		nla_nest_end(msg, reasons);
	}

11105
	genlmsg_end(msg, hdr);
11106 11107 11108 11109 11110 11111 11112 11113 11114 11115 11116

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 free_msg:
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
#endif

11117 11118 11119 11120 11121 11122 11123 11124 11125 11126 11127 11128 11129 11130 11131 11132 11133 11134 11135 11136 11137 11138 11139 11140 11141 11142 11143 11144 11145 11146
void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
				enum nl80211_tdls_operation oper,
				u16 reason_code, gfp_t gfp)
{
	struct wireless_dev *wdev = dev->ieee80211_ptr;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
	struct sk_buff *msg;
	void *hdr;

	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
					 reason_code);

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
	    (reason_code > 0 &&
	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
		goto nla_put_failure;

11147
	genlmsg_end(msg, hdr);
11148 11149 11150 11151 11152 11153 11154 11155 11156 11157 11158

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, gfp);
	return;

 nla_put_failure:
	genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);
}
EXPORT_SYMBOL(cfg80211_tdls_oper_request);

11159 11160 11161 11162 11163 11164 11165
static int nl80211_netlink_notify(struct notifier_block * nb,
				  unsigned long state,
				  void *_notify)
{
	struct netlink_notify *notify = _notify;
	struct cfg80211_registered_device *rdev;
	struct wireless_dev *wdev;
11166
	struct cfg80211_beacon_registration *reg, *tmp;
11167 11168 11169 11170 11171 11172

	if (state != NETLINK_URELEASE)
		return NOTIFY_DONE;

	rcu_read_lock();

11173
	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11174
		list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11175
			cfg80211_mlme_unregister_socket(wdev, notify->portid);
11176 11177 11178 11179 11180 11181 11182 11183 11184 11185 11186

		spin_lock_bh(&rdev->beacon_registrations_lock);
		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
					 list) {
			if (reg->nlportid == notify->portid) {
				list_del(&reg->list);
				kfree(reg);
				break;
			}
		}
		spin_unlock_bh(&rdev->beacon_registrations_lock);
11187
	}
11188 11189 11190 11191 11192 11193 11194 11195 11196 11197

	rcu_read_unlock();

	return NOTIFY_DONE;
}

static struct notifier_block nl80211_netlink_notifier = {
	.notifier_call = nl80211_netlink_notify,
};

11198 11199 11200 11201 11202 11203 11204 11205 11206 11207 11208 11209 11210 11211 11212 11213 11214 11215 11216 11217 11218 11219 11220 11221 11222 11223 11224 11225 11226 11227 11228 11229
void cfg80211_ft_event(struct net_device *netdev,
		       struct cfg80211_ft_event_params *ft_event)
{
	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
	struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
	struct sk_buff *msg;
	void *hdr;

	trace_cfg80211_ft_event(wiphy, netdev, ft_event);

	if (!ft_event->target_ap)
		return;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
	if (!hdr) {
		nlmsg_free(msg);
		return;
	}

	nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
	nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
	nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
	if (ft_event->ies)
		nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
	if (ft_event->ric_ies)
		nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
			ft_event->ric_ies);

11230
	genlmsg_end(msg, hdr);
11231 11232 11233 11234 11235 11236

	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
				nl80211_mlme_mcgrp.id, GFP_KERNEL);
}
EXPORT_SYMBOL(cfg80211_ft_event);

11237 11238 11239 11240 11241 11242 11243 11244 11245 11246 11247 11248 11249 11250 11251 11252 11253 11254 11255 11256 11257 11258 11259 11260 11261 11262 11263 11264 11265 11266 11267 11268 11269 11270 11271 11272 11273 11274 11275
void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
{
	struct cfg80211_registered_device *rdev;
	struct sk_buff *msg;
	void *hdr;
	u32 nlportid;

	rdev = wiphy_to_dev(wdev->wiphy);
	if (!rdev->crit_proto_nlportid)
		return;

	nlportid = rdev->crit_proto_nlportid;
	rdev->crit_proto_nlportid = 0;

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
	if (!msg)
		return;

	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
	if (!hdr)
		goto nla_put_failure;

	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
		goto nla_put_failure;

	genlmsg_end(msg, hdr);

	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
	return;

 nla_put_failure:
	if (hdr)
		genlmsg_cancel(msg, hdr);
	nlmsg_free(msg);

}
EXPORT_SYMBOL(cfg80211_crit_proto_stopped);

11276 11277 11278 11279
/* initialisation/exit functions */

int nl80211_init(void)
{
11280
	int err;
11281

11282 11283
	err = genl_register_family_with_ops(&nl80211_fam,
		nl80211_ops, ARRAY_SIZE(nl80211_ops));
11284 11285 11286 11287 11288 11289 11290
	if (err)
		return err;

	err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
	if (err)
		goto err_out;

11291 11292 11293 11294
	err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
	if (err)
		goto err_out;

11295 11296 11297 11298
	err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
	if (err)
		goto err_out;

11299 11300 11301 11302
	err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
	if (err)
		goto err_out;

11303 11304 11305 11306 11307 11308
#ifdef CONFIG_NL80211_TESTMODE
	err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
	if (err)
		goto err_out;
#endif

11309 11310 11311 11312
	err = netlink_register_notifier(&nl80211_netlink_notifier);
	if (err)
		goto err_out;

11313 11314 11315 11316 11317 11318 11319 11320
	return 0;
 err_out:
	genl_unregister_family(&nl80211_fam);
	return err;
}

void nl80211_exit(void)
{
11321
	netlink_unregister_notifier(&nl80211_netlink_notifier);
11322 11323
	genl_unregister_family(&nl80211_fam);
}